Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 06:48
Static task
static1
Behavioral task
behavioral1
Sample
192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
192c731e822a64cce6dc9a6725d7b651
-
SHA1
288c85400ea2abad7f29cde9f90658e9876d1710
-
SHA256
11c0e397d62858a5a59ffc635eff294ae5bf5aaf5b94f97e48ef86b599e0987e
-
SHA512
b6f7925f4cd8b445092a947d89f492744520132abacd9bfc3535e2b406ed797490cebb3315dffd93413bba61e8f333d0429c5c942b0362b85c783e5611980006
-
SSDEEP
24576:Kb2/DbTeyIuPVJFFDHZWCaIYm1hCcDOmi:f/lDoC1O
Malware Config
Extracted
darkcomet
Guest16
darkcomet2013.no-ip.biz:1500
192.168.1.71:1500
DC_MUTEX-9LQ2QJ5
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
30ibXWq2y5dh
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 24 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe926.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 926.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe -
Sets file to hidden 1 TTPs 46 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 2396 attrib.exe 2032 attrib.exe 1720 attrib.exe 1388 attrib.exe 1476 attrib.exe 2948 attrib.exe 772 attrib.exe 1332 attrib.exe 2976 attrib.exe 1972 attrib.exe 2924 attrib.exe 2256 attrib.exe 2800 attrib.exe 2972 attrib.exe 1708 attrib.exe 1652 attrib.exe 3048 attrib.exe 2560 attrib.exe 2104 attrib.exe 2740 attrib.exe 1708 attrib.exe 2116 attrib.exe 620 attrib.exe 2360 attrib.exe 712 attrib.exe 1692 attrib.exe 1696 attrib.exe 1104 attrib.exe 2192 attrib.exe 1648 attrib.exe 1616 attrib.exe 1780 attrib.exe 2296 attrib.exe 1200 attrib.exe 2848 attrib.exe 2940 attrib.exe 2008 attrib.exe 2260 attrib.exe 2828 attrib.exe 2472 attrib.exe 2032 attrib.exe 2780 attrib.exe 1700 attrib.exe 952 attrib.exe 1488 attrib.exe 592 attrib.exe -
Executes dropped EXE 24 IoCs
Processes:
926.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 2736 926.exe 2848 msdcsc.exe 2928 msdcsc.exe 964 msdcsc.exe 1688 msdcsc.exe 3000 msdcsc.exe 2056 msdcsc.exe 1800 msdcsc.exe 1700 msdcsc.exe 2704 msdcsc.exe 2920 msdcsc.exe 968 msdcsc.exe 1304 msdcsc.exe 1488 msdcsc.exe 2484 msdcsc.exe 1580 msdcsc.exe 2808 msdcsc.exe 2968 msdcsc.exe 1720 msdcsc.exe 2832 msdcsc.exe 1448 msdcsc.exe 2348 msdcsc.exe 2360 msdcsc.exe 2912 msdcsc.exe -
Loads dropped DLL 46 IoCs
Processes:
926.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 2736 926.exe 2736 926.exe 2848 msdcsc.exe 2848 msdcsc.exe 2928 msdcsc.exe 2928 msdcsc.exe 964 msdcsc.exe 964 msdcsc.exe 1688 msdcsc.exe 1688 msdcsc.exe 3000 msdcsc.exe 3000 msdcsc.exe 2056 msdcsc.exe 2056 msdcsc.exe 1800 msdcsc.exe 1800 msdcsc.exe 1700 msdcsc.exe 1700 msdcsc.exe 2704 msdcsc.exe 2704 msdcsc.exe 2920 msdcsc.exe 2920 msdcsc.exe 968 msdcsc.exe 968 msdcsc.exe 1304 msdcsc.exe 1304 msdcsc.exe 1488 msdcsc.exe 1488 msdcsc.exe 2484 msdcsc.exe 2484 msdcsc.exe 1580 msdcsc.exe 1580 msdcsc.exe 2808 msdcsc.exe 2808 msdcsc.exe 2968 msdcsc.exe 2968 msdcsc.exe 1720 msdcsc.exe 1720 msdcsc.exe 2832 msdcsc.exe 2832 msdcsc.exe 1448 msdcsc.exe 1448 msdcsc.exe 2348 msdcsc.exe 2348 msdcsc.exe 2360 msdcsc.exe 2360 msdcsc.exe -
Adds Run key to start application 2 TTPs 24 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe926.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 926.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 64 IoCs
Processes:
attrib.exemsdcsc.exeattrib.exemsdcsc.exe926.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exeattrib.exeattrib.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 926.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 926.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 926.exe File opened for modification C:\Windows\SysWOW64\MSDCSC attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh attrib.exe File created C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\ msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
926.exemsdcsc.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2736 926.exe Token: SeSecurityPrivilege 2736 926.exe Token: SeTakeOwnershipPrivilege 2736 926.exe Token: SeLoadDriverPrivilege 2736 926.exe Token: SeSystemProfilePrivilege 2736 926.exe Token: SeSystemtimePrivilege 2736 926.exe Token: SeProfSingleProcessPrivilege 2736 926.exe Token: SeIncBasePriorityPrivilege 2736 926.exe Token: SeCreatePagefilePrivilege 2736 926.exe Token: SeBackupPrivilege 2736 926.exe Token: SeRestorePrivilege 2736 926.exe Token: SeShutdownPrivilege 2736 926.exe Token: SeDebugPrivilege 2736 926.exe Token: SeSystemEnvironmentPrivilege 2736 926.exe Token: SeChangeNotifyPrivilege 2736 926.exe Token: SeRemoteShutdownPrivilege 2736 926.exe Token: SeUndockPrivilege 2736 926.exe Token: SeManageVolumePrivilege 2736 926.exe Token: SeImpersonatePrivilege 2736 926.exe Token: SeCreateGlobalPrivilege 2736 926.exe Token: 33 2736 926.exe Token: 34 2736 926.exe Token: 35 2736 926.exe Token: SeIncreaseQuotaPrivilege 2848 msdcsc.exe Token: SeSecurityPrivilege 2848 msdcsc.exe Token: SeTakeOwnershipPrivilege 2848 msdcsc.exe Token: SeLoadDriverPrivilege 2848 msdcsc.exe Token: SeSystemProfilePrivilege 2848 msdcsc.exe Token: SeSystemtimePrivilege 2848 msdcsc.exe Token: SeProfSingleProcessPrivilege 2848 msdcsc.exe Token: SeIncBasePriorityPrivilege 2848 msdcsc.exe Token: SeCreatePagefilePrivilege 2848 msdcsc.exe Token: SeBackupPrivilege 2848 msdcsc.exe Token: SeRestorePrivilege 2848 msdcsc.exe Token: SeShutdownPrivilege 2848 msdcsc.exe Token: SeDebugPrivilege 2848 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2848 msdcsc.exe Token: SeChangeNotifyPrivilege 2848 msdcsc.exe Token: SeRemoteShutdownPrivilege 2848 msdcsc.exe Token: SeUndockPrivilege 2848 msdcsc.exe Token: SeManageVolumePrivilege 2848 msdcsc.exe Token: SeImpersonatePrivilege 2848 msdcsc.exe Token: SeCreateGlobalPrivilege 2848 msdcsc.exe Token: 33 2848 msdcsc.exe Token: 34 2848 msdcsc.exe Token: 35 2848 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2928 msdcsc.exe Token: SeSecurityPrivilege 2928 msdcsc.exe Token: SeTakeOwnershipPrivilege 2928 msdcsc.exe Token: SeLoadDriverPrivilege 2928 msdcsc.exe Token: SeSystemProfilePrivilege 2928 msdcsc.exe Token: SeSystemtimePrivilege 2928 msdcsc.exe Token: SeProfSingleProcessPrivilege 2928 msdcsc.exe Token: SeIncBasePriorityPrivilege 2928 msdcsc.exe Token: SeCreatePagefilePrivilege 2928 msdcsc.exe Token: SeBackupPrivilege 2928 msdcsc.exe Token: SeRestorePrivilege 2928 msdcsc.exe Token: SeShutdownPrivilege 2928 msdcsc.exe Token: SeDebugPrivilege 2928 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2928 msdcsc.exe Token: SeChangeNotifyPrivilege 2928 msdcsc.exe Token: SeRemoteShutdownPrivilege 2928 msdcsc.exe Token: SeUndockPrivilege 2928 msdcsc.exe Token: SeManageVolumePrivilege 2928 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe926.execmd.execmd.exemsdcsc.execmd.execmd.exemsdcsc.execmd.execmd.exedescription pid process target process PID 2240 wrote to memory of 2736 2240 192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe 926.exe PID 2240 wrote to memory of 2736 2240 192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe 926.exe PID 2240 wrote to memory of 2736 2240 192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe 926.exe PID 2240 wrote to memory of 2736 2240 192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe 926.exe PID 2736 wrote to memory of 2812 2736 926.exe cmd.exe PID 2736 wrote to memory of 2812 2736 926.exe cmd.exe PID 2736 wrote to memory of 2812 2736 926.exe cmd.exe PID 2736 wrote to memory of 2812 2736 926.exe cmd.exe PID 2736 wrote to memory of 2836 2736 926.exe cmd.exe PID 2736 wrote to memory of 2836 2736 926.exe cmd.exe PID 2736 wrote to memory of 2836 2736 926.exe cmd.exe PID 2736 wrote to memory of 2836 2736 926.exe cmd.exe PID 2836 wrote to memory of 2560 2836 cmd.exe attrib.exe PID 2836 wrote to memory of 2560 2836 cmd.exe attrib.exe PID 2836 wrote to memory of 2560 2836 cmd.exe attrib.exe PID 2836 wrote to memory of 2560 2836 cmd.exe attrib.exe PID 2812 wrote to memory of 2360 2812 cmd.exe attrib.exe PID 2812 wrote to memory of 2360 2812 cmd.exe attrib.exe PID 2812 wrote to memory of 2360 2812 cmd.exe attrib.exe PID 2812 wrote to memory of 2360 2812 cmd.exe attrib.exe PID 2736 wrote to memory of 2848 2736 926.exe msdcsc.exe PID 2736 wrote to memory of 2848 2736 926.exe msdcsc.exe PID 2736 wrote to memory of 2848 2736 926.exe msdcsc.exe PID 2736 wrote to memory of 2848 2736 926.exe msdcsc.exe PID 2848 wrote to memory of 2100 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2100 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2100 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2100 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2044 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2044 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2044 2848 msdcsc.exe cmd.exe PID 2848 wrote to memory of 2044 2848 msdcsc.exe cmd.exe PID 2100 wrote to memory of 2924 2100 cmd.exe attrib.exe PID 2100 wrote to memory of 2924 2100 cmd.exe attrib.exe PID 2100 wrote to memory of 2924 2100 cmd.exe attrib.exe PID 2100 wrote to memory of 2924 2100 cmd.exe attrib.exe PID 2044 wrote to memory of 2940 2044 cmd.exe attrib.exe PID 2044 wrote to memory of 2940 2044 cmd.exe attrib.exe PID 2044 wrote to memory of 2940 2044 cmd.exe attrib.exe PID 2044 wrote to memory of 2940 2044 cmd.exe attrib.exe PID 2848 wrote to memory of 2928 2848 msdcsc.exe msdcsc.exe PID 2848 wrote to memory of 2928 2848 msdcsc.exe msdcsc.exe PID 2848 wrote to memory of 2928 2848 msdcsc.exe msdcsc.exe PID 2848 wrote to memory of 2928 2848 msdcsc.exe msdcsc.exe PID 2928 wrote to memory of 2184 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 2184 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 2184 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 2184 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 1912 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 1912 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 1912 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 1912 2928 msdcsc.exe cmd.exe PID 2928 wrote to memory of 964 2928 msdcsc.exe msdcsc.exe PID 2928 wrote to memory of 964 2928 msdcsc.exe msdcsc.exe PID 2928 wrote to memory of 964 2928 msdcsc.exe msdcsc.exe PID 2928 wrote to memory of 964 2928 msdcsc.exe msdcsc.exe PID 1912 wrote to memory of 2008 1912 cmd.exe attrib.exe PID 1912 wrote to memory of 2008 1912 cmd.exe attrib.exe PID 1912 wrote to memory of 2008 1912 cmd.exe attrib.exe PID 1912 wrote to memory of 2008 1912 cmd.exe attrib.exe PID 2184 wrote to memory of 1708 2184 cmd.exe attrib.exe PID 2184 wrote to memory of 1708 2184 cmd.exe attrib.exe PID 2184 wrote to memory of 1708 2184 cmd.exe attrib.exe PID 2184 wrote to memory of 1708 2184 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 46 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 2740 attrib.exe 1780 attrib.exe 1648 attrib.exe 3048 attrib.exe 2940 attrib.exe 2104 attrib.exe 2472 attrib.exe 2260 attrib.exe 2924 attrib.exe 1104 attrib.exe 2296 attrib.exe 1200 attrib.exe 2032 attrib.exe 2800 attrib.exe 1708 attrib.exe 1720 attrib.exe 1972 attrib.exe 2116 attrib.exe 2360 attrib.exe 2008 attrib.exe 2780 attrib.exe 1708 attrib.exe 1476 attrib.exe 1696 attrib.exe 2192 attrib.exe 712 attrib.exe 2828 attrib.exe 1332 attrib.exe 2396 attrib.exe 772 attrib.exe 1616 attrib.exe 2976 attrib.exe 1692 attrib.exe 2848 attrib.exe 1652 attrib.exe 952 attrib.exe 2948 attrib.exe 592 attrib.exe 2256 attrib.exe 1388 attrib.exe 2972 attrib.exe 620 attrib.exe 1700 attrib.exe 2560 attrib.exe 1488 attrib.exe 2032 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\926.exeC:\Users\Admin\AppData\Local\Temp\926.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\926.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\926.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC" +s +h5⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h6⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h7⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h6⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h7⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h7⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h8⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h7⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h8⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h8⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h9⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h8⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h9⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h9⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h10⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h9⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h10⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h10⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h10⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h11⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h11⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h12⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h11⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h12⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"11⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h12⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h12⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h13⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h13⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h13⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h14⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h15⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h14⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h15⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"14⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h15⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h16⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h15⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h16⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h17⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h16⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h17⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"16⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h17⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h18⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h17⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"17⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h18⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h19⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h18⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h19⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h19⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h20⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h19⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h20⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"19⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h20⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h21⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h20⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h21⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"20⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h21⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h21⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h22⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h22⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h23⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h24⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h23⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h24⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"23⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h24⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h24⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h25⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h26⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h25⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h26⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"25⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\926.exeFilesize
692KB
MD592cebc5cd470ea94f6cf3c228a09f903
SHA1982e38abbb25f8783569326c9dd2c5e51fb051f9
SHA25611e73e162c3f6dab132b6d7dd33bae321f30a6a703f9c082a79359c501d2d887
SHA51262be2cc36bb5bf376b73bbb09c1c2577d98a56bfae844bd6963ca746936209121da05549ca9923793c0318420c8bc4aa3777c8f91d1ca7b055f67319bfc1ea0e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/964-60-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/968-150-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1304-162-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1448-230-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1488-173-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1580-191-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1688-73-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1700-116-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1720-218-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/1800-105-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2056-94-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2240-51-0x000007FEF59D0000-0x000007FEF636D000-memory.dmpFilesize
9.6MB
-
memory/2240-0-0x000007FEF5C8E000-0x000007FEF5C8F000-memory.dmpFilesize
4KB
-
memory/2240-7-0x000007FEF59D0000-0x000007FEF636D000-memory.dmpFilesize
9.6MB
-
memory/2260-101-0x00000000775D0000-0x00000000776CA000-memory.dmpFilesize
1000KB
-
memory/2260-100-0x00000000776D0000-0x00000000777EF000-memory.dmpFilesize
1.1MB
-
memory/2348-239-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2360-248-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2484-182-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2704-130-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2736-11-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2736-21-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2808-200-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2832-221-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2848-34-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2920-138-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2928-46-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2968-209-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/3000-81-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB