luminosity | 2b01e2e497bc8f992d23ecabf99536cc759af1acf2482197f602d22eec20513e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Size 2.0MB
Sample261016-e4mvpag18y
SHA256 2b01e2e497bc8f992d23ecabf99536cc759af1acf2482197f602d22eec20513e
MD5 371d6af259f163977316d1f4b73d64d2
SHA1 51e954c183fb94e412ebcd6c73777895916c8a86
SHA512 4938ea8e84cce02846faf59c2c2957b09899495d4316acea67da0513757517d9fe991318d2e61e4f79ad3a64a08b0cb33c53bda6cbcbda9e448fa95ee82196fa
SSDEEP 49152:vSxC1sHFzalvA39JW3Vq6wixkPYRcilWihwVRFOVtA/B:v0gK39J8ZxKYRcilXgRn/B
TLSH
T1A9A523152BFB60D9F33EAB7D4BF6FD66DA26E332250677EE0001E3554822840DE91A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 7 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

pid	Process
1296	schtasks.exe
4184	schtasks.exe
2376	schtasks.exe
5016	schtasks.exe
552	schtasks.exe
5096	schtasks.exe
1412	schtasks.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	books.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	books.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Security.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Security.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Security.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Security.exe

Executes dropped EXE 14 IoCs

pid	Process
2780	books.exe
3172	books.exe
3924	books.exe
436	books.exe
1760	Security.exe
3248	Security.exe
3248	Security.exe
3884	Security.exe
5084	Security.exe
4756	Security.exe
4468	Security.exe
4764	Security.exe
5020	Security.exe
5000	Security.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Security = "cmd /c \"start \"Security\" \"C:\\Program Files (x86)\\Security\\Security.exe\""	REG.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	books.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	books.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 3172	2780	books.exe	94
PID 3924 set thread context of 436	3924	books.exe	103
PID 1760 set thread context of 3248	1760	Security.exe	117
PID 3248 set thread context of 5084	3248	Security.exe	137
PID 4756 set thread context of 4764	4756	Security.exe	144
PID 5020 set thread context of 5000	5020	Security.exe	153

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Security\Security.exe	books.exe
File opened for modification	C:\Program Files (x86)\Security\Security.exe	books.exe
File created	C:\Program Files (x86)\Security\Security.exe	books.exe
File opened for modification	C:\Program Files (x86)\Security\Security.exe	books.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	books.exe
File created	C:\Windows\assembly\Desktop.ini	books.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	books.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	books.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	books.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	books.exe

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe
3172	books.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3172	books.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Token: SeDebugPrivilege	2780	books.exe
Token: SeDebugPrivilege	3924	books.exe
Token: SeDebugPrivilege	3172	books.exe
Token: SeDebugPrivilege	1760	Security.exe
Token: SeDebugPrivilege	3248	Security.exe
Token: SeDebugPrivilege	4756	Security.exe
Token: SeDebugPrivilege	5020	Security.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3172	books.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2780	3488	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe	89
PID 2780 wrote to memory of 3832	2780	books.exe	90
PID 2780 wrote to memory of 5016	2780	books.exe	92
PID 2780 wrote to memory of 3172	2780	books.exe	94
PID 2780 wrote to memory of 3172	2780	books.exe	94
PID 2780 wrote to memory of 3172	2780	books.exe	94
PID 2780 wrote to memory of 3172	2780	books.exe	94
PID 2780 wrote to memory of 3172	2780	books.exe	94
PID 3924 wrote to memory of 3736	3924	books.exe	99
PID 3924 wrote to memory of 552	3924	books.exe	101
PID 3924 wrote to memory of 436	3924	books.exe	103
PID 3924 wrote to memory of 436	3924	books.exe	103
PID 3924 wrote to memory of 436	3924	books.exe	103
PID 3924 wrote to memory of 436	3924	books.exe	103
PID 3924 wrote to memory of 436	3924	books.exe	103
PID 3172 wrote to memory of 5096	3172	books.exe	109
PID 1760 wrote to memory of 4224	1760	Security.exe	113
PID 1760 wrote to memory of 1412	1760	Security.exe	115
PID 1760 wrote to memory of 3248	1760	Security.exe	117
PID 1760 wrote to memory of 3248	1760	Security.exe	117
PID 1760 wrote to memory of 3248	1760	Security.exe	117
PID 1760 wrote to memory of 3248	1760	Security.exe	117
PID 1760 wrote to memory of 3248	1760	Security.exe	117
PID 3172 wrote to memory of 1044	3172	books.exe	127
PID 464 wrote to memory of 3248	464	cmd.exe	131
PID 3248 wrote to memory of 940	3248	Security.exe	132
PID 3248 wrote to memory of 1296	3248	Security.exe	134
PID 3248 wrote to memory of 3884	3248	Security.exe	136
PID 3248 wrote to memory of 5084	3248	Security.exe	137
PID 3248 wrote to memory of 5084	3248	Security.exe	137
PID 3248 wrote to memory of 5084	3248	Security.exe	137
PID 3248 wrote to memory of 5084	3248	Security.exe	137
PID 3248 wrote to memory of 5084	3248	Security.exe	137
PID 4756 wrote to memory of 4824	4756	Security.exe	139
PID 4756 wrote to memory of 4184	4756	Security.exe	141
PID 4756 wrote to memory of 4468	4756	Security.exe	143
PID 4756 wrote to memory of 4764	4756	Security.exe	144
PID 4756 wrote to memory of 4764	4756	Security.exe	144
PID 4756 wrote to memory of 4764	4756	Security.exe	144
PID 4756 wrote to memory of 4764	4756	Security.exe	144
PID 4756 wrote to memory of 4764	4756	Security.exe	144
PID 5020 wrote to memory of 1392	5020	Security.exe	149
PID 5020 wrote to memory of 2376	5020	Security.exe	151
PID 5020 wrote to memory of 5000	5020	Security.exe	153
PID 5020 wrote to memory of 5000	5020	Security.exe	153
PID 5020 wrote to memory of 5000	5020	Security.exe	153
PID 5020 wrote to memory of 5000	5020	Security.exe	153
PID 5020 wrote to memory of 5000	5020	Security.exe	153
PID 3172 wrote to memory of 5000	3172	books.exe	153
PID 3172 wrote to memory of 5000	3172	books.exe	153
PID 3172 wrote to memory of 5000	3172	books.exe	153
PID 3172 wrote to memory of 5000	3172	books.exe	153

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Roaming\books.exe
  "C:\Users\Admin\AppData\Roaming\books.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\935685845.xml"
    3⤵
    - Family: Luminosity
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Users\Admin\AppData\Roaming\books.exe
    "C:\Users\Admin\AppData\Roaming\books.exe "
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "Security" /tr "'C:\Program Files (x86)\Security\Security.exe' /startup" /sc MINUTE /f /rl highest
      4⤵
      Family: Luminosity
      System Location Discovery: System Language Discovery
      PID:5096
  - - C:\Windows\SysWOW64\REG.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Security" /d "cmd /c """start """Security""" """C:\Program Files (x86)\Security\Security.exe"""" /f /reg:64
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1044

C:\Users\Admin\AppData\Roaming\books.exe
C:\Users\Admin\AppData\Roaming\books.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3736
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\1924084303.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Users\Admin\AppData\Roaming\books.exe
  "C:\Users\Admin\AppData\Roaming\books.exe "
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:436

C:\Program Files (x86)\Security\Security.exe
"C:\Program Files (x86)\Security\Security.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4224
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\507490482.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  PID:1412
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3248

C:\Windows\system32\cmd.exe
"cmd /c "start "Security" "C:\Program Files (x86)\Security\Security.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\1681667065.xml"
    3⤵
    - Family: Luminosity
    - System Location Discovery: System Language Discovery
    PID:1296
- - C:\Program Files (x86)\Security\Security.exe
    "C:\Program Files (x86)\Security\Security.exe "
    3⤵
    - Executes dropped EXE
    PID:3884
- - C:\Program Files (x86)\Security\Security.exe
    "C:\Program Files (x86)\Security\Security.exe "
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5084

C:\Program Files (x86)\Security\Security.exe
"C:\Program Files (x86)\Security\Security.exe" /startup
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4824
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\565532663.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  PID:4184
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe /startup"
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe /startup"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4764

C:\Program Files (x86)\Security\Security.exe
"C:\Program Files (x86)\Security\Security.exe" /startup
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1392
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\2143357901.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2376
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe /startup"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Security.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Security.exe.log
Size 499B
SHA256 a36ac95a90d6ff621e40461ad4a179fd1e46161bb82c6ebc320175f671713e54
MD5 61effab21c1a284c30a4e2ae78dc6332
SHA1 adaa5872f128145301c546936edb81390723dc3c
SHA512 653158066d1f18faf69fd6d67ee5cc7aaf8bab0ed75aa6d5685675faf0c39d53bac88192dc265442ab60bd316499fa754cfb67097914846a8308a386d8c49ff8
TLSH
T18CF02730362198D40C212B110800BFDA66FF475A7B689E1C656A635DED2A497EB116E3
MD5 SHA1 SHA512 TLSH

Submit Download

books.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\books.exe.log
Size 319B
SHA256 1493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
MD5 600936e187ce94453648a9245b2b42a5
SHA1 3349e5da3f713259244a2cbcb4a9dca777f637ed
SHA512 d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964
TLSH
T167E07230373284E408203A1008027FDA55FF43576768EE2C1619539EE82A0A7EF102E3
MD5 SHA1 SHA512 TLSH

Submit Download

507490482.xml

Path C:\Users\Admin\AppData\Local\Temp\507490482.xml
Size 1KB
SHA256 96616254c44410317800738c9c96f805020af27f982b61bd840ed0541107e260
MD5 6c40c3314e447df11dd74a85c397d8bd
SHA1 e03a13358bac2f40459468ce8d77f7d90192d3bd
SHA512 cdce33a2c2180703f93e399cde11a64cd4b7b345c2b1e7218d6abbb14438e4545eea8d1d3523dd5003bec2dcb9128ef5613c83264f56f4ddf7335ea4179319be
TLSH
T16F310E649CC0BB176572412AE3824682EF6697A706570039F5CC0B7B2FB65862243577
MD5 SHA1 SHA512 TLSH

Submit Download

935685845.xml

Path C:\Users\Admin\AppData\Local\Temp\935685845.xml
Size 1KB
SHA256 8f4153490e4d1aa6f45f6a9f799f1d66ca60e730ab12ec671685638015b7f6cd
MD5 6ba0d12af84bf8c8fd9302e0128e3cc0
SHA1 a71744d5e71669f4b0f7b003161fbb55cfe65253
SHA512 e74ce5f55344f7be14b6d22607caf3044bff402fe9d9b387a544937cde9a1d9acc4fde78682c6f0736253fabe242426fc24f743886ae262c528493a9d19dcb98
TLSH
T19231F0649CD0BB1B6572413AE7429283EF7797A30A560039F5CC0BBF2FB65462243577
MD5 SHA1 SHA512 TLSH

Submit Download

books.exe

Path C:\Users\Admin\AppData\Roaming\books.exe
Size 2.0MB
SHA256 2b01e2e497bc8f992d23ecabf99536cc759af1acf2482197f602d22eec20513e
MD5 371d6af259f163977316d1f4b73d64d2
SHA1 51e954c183fb94e412ebcd6c73777895916c8a86
SHA512 4938ea8e84cce02846faf59c2c2957b09899495d4316acea67da0513757517d9fe991318d2e61e4f79ad3a64a08b0cb33c53bda6cbcbda9e448fa95ee82196fa
SSDEEP 49152:vSxC1sHFzalvA39JW3Vq6wixkPYRcilWihwVRFOVtA/B:v0gK39J8ZxKYRcilXgRn/B
TLSH
T1A9A523152BFB60D9F33EAB7D4BF6FD66DA26E332250677EE0001E3554822840DE91A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2780-15-0x0000000075330000-0x00000000758E1000-memory.dmp

Download

memory/2780-14-0x0000000075330000-0x00000000758E1000-memory.dmp

Download

memory/2780-22-0x0000000075330000-0x00000000758E1000-memory.dmp

Download

memory/3172-18-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/3172-21-0x0000000075330000-0x00000000758E1000-memory.dmp

Download

memory/3172-34-0x0000000075330000-0x00000000758E1000-memory.dmp

Download

memory/3488-1-0x0000000075332000-0x0000000075334000-memory.dmp

Download

memory/3488-0-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Download

memory/5000-61-0x00000000066C0000-0x00000000066D7000-memory.dmp

Download

memory/5000-62-0x00000000066C0000-0x00000000066D7000-memory.dmp

Download

memory/5000-64-0x00000000066E0000-0x00000000066E1000-memory.dmp

Download

memory/5000-63-0x00000000066C0000-0x00000000066D7000-memory.dmp

Download

memory/5000-65-0x00000000066C0000-0x00000000066D7000-memory.dmp

Download

memory/5000-67-0x00000000066C0000-0x00000000066D7000-memory.dmp

Download