darkcomet | 11c0e397d62858a5a59ffc635eff294ae5bf5aaf5b94f97e48ef86b599e0987e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe
Size

1.8MB
MD5

192c731e822a64cce6dc9a6725d7b651
SHA1

288c85400ea2abad7f29cde9f90658e9876d1710
SHA256

11c0e397d62858a5a59ffc635eff294ae5bf5aaf5b94f97e48ef86b599e0987e
SHA512

b6f7925f4cd8b445092a947d89f492744520132abacd9bfc3535e2b406ed797490cebb3315dffd93413bba61e8f333d0429c5c942b0362b85c783e5611980006
SSDEEP

24576:Kb2/DbTeyIuPVJFFDHZWCaIYm1hCcDOmi:f/lDoC1O

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

darkcomet2013.no-ip.biz:1500

192.168.1.71:1500

Mutex

DC_MUTEX-9LQ2QJ5

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
30ibXWq2y5dh
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 23 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe186.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	186.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe

Sets file to hidden 1 TTPs 44 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
3920	attrib.exe
4336	attrib.exe
2728	attrib.exe
392	attrib.exe
5152	attrib.exe
2304	attrib.exe
2492	attrib.exe
4696	attrib.exe
5764	attrib.exe
1212	attrib.exe
1604	attrib.exe
1040	attrib.exe
4128	attrib.exe
1680	attrib.exe
4760	attrib.exe
5576	attrib.exe
4760	attrib.exe
2932	attrib.exe
1832	attrib.exe
2340	attrib.exe
4840	attrib.exe
2036	attrib.exe
4516	attrib.exe
2492	attrib.exe
5284	attrib.exe
5696	attrib.exe
5592	attrib.exe
4052	attrib.exe
4048	attrib.exe
1604	attrib.exe
5276	attrib.exe
4168	attrib.exe
5692	attrib.exe
6136	attrib.exe
3008	attrib.exe
2184	attrib.exe
5776	attrib.exe
1172	attrib.exe
2080	attrib.exe
2064	attrib.exe
1688	attrib.exe
2676	attrib.exe
6000	attrib.exe
5040	attrib.exe

Checks computer location settings 2 TTPs 22 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msdcsc.exe186.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	186.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Executes dropped EXE 23 IoCs

Processes:

186.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
4208	186.exe
1624	msdcsc.exe
5084	msdcsc.exe
4996	msdcsc.exe
2184	msdcsc.exe
4488	msdcsc.exe
452	msdcsc.exe
2404	msdcsc.exe
2072	msdcsc.exe
4440	msdcsc.exe
4736	msdcsc.exe
1200	msdcsc.exe
3796	msdcsc.exe
2576	msdcsc.exe
5024	msdcsc.exe
5328	msdcsc.exe
5824	msdcsc.exe
5168	msdcsc.exe
5640	msdcsc.exe
6044	msdcsc.exe
4368	msdcsc.exe
6024	msdcsc.exe
6096	msdcsc.exe

Adds Run key to start application 2 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe186.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	186.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\30ibXWq2y5dh\\30ibXWq2y5dh\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 64 IoCs

Processes:

msdcsc.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exe186.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	186.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	186.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 22 IoCs

Processes:

msdcsc.exemsdcsc.exe186.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	186.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

186.exemsdcsc.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4208	186.exe
Token: SeSecurityPrivilege	4208	186.exe
Token: SeTakeOwnershipPrivilege	4208	186.exe
Token: SeLoadDriverPrivilege	4208	186.exe
Token: SeSystemProfilePrivilege	4208	186.exe
Token: SeSystemtimePrivilege	4208	186.exe
Token: SeProfSingleProcessPrivilege	4208	186.exe
Token: SeIncBasePriorityPrivilege	4208	186.exe
Token: SeCreatePagefilePrivilege	4208	186.exe
Token: SeBackupPrivilege	4208	186.exe
Token: SeRestorePrivilege	4208	186.exe
Token: SeShutdownPrivilege	4208	186.exe
Token: SeDebugPrivilege	4208	186.exe
Token: SeSystemEnvironmentPrivilege	4208	186.exe
Token: SeChangeNotifyPrivilege	4208	186.exe
Token: SeRemoteShutdownPrivilege	4208	186.exe
Token: SeUndockPrivilege	4208	186.exe
Token: SeManageVolumePrivilege	4208	186.exe
Token: SeImpersonatePrivilege	4208	186.exe
Token: SeCreateGlobalPrivilege	4208	186.exe
Token: 33	4208	186.exe
Token: 34	4208	186.exe
Token: 35	4208	186.exe
Token: 36	4208	186.exe
Token: SeIncreaseQuotaPrivilege	1624	msdcsc.exe
Token: SeSecurityPrivilege	1624	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1624	msdcsc.exe
Token: SeLoadDriverPrivilege	1624	msdcsc.exe
Token: SeSystemProfilePrivilege	1624	msdcsc.exe
Token: SeSystemtimePrivilege	1624	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1624	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1624	msdcsc.exe
Token: SeCreatePagefilePrivilege	1624	msdcsc.exe
Token: SeBackupPrivilege	1624	msdcsc.exe
Token: SeRestorePrivilege	1624	msdcsc.exe
Token: SeShutdownPrivilege	1624	msdcsc.exe
Token: SeDebugPrivilege	1624	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1624	msdcsc.exe
Token: SeChangeNotifyPrivilege	1624	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1624	msdcsc.exe
Token: SeUndockPrivilege	1624	msdcsc.exe
Token: SeManageVolumePrivilege	1624	msdcsc.exe
Token: SeImpersonatePrivilege	1624	msdcsc.exe
Token: SeCreateGlobalPrivilege	1624	msdcsc.exe
Token: 33	1624	msdcsc.exe
Token: 34	1624	msdcsc.exe
Token: 35	1624	msdcsc.exe
Token: 36	1624	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	5084	msdcsc.exe
Token: SeSecurityPrivilege	5084	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5084	msdcsc.exe
Token: SeLoadDriverPrivilege	5084	msdcsc.exe
Token: SeSystemProfilePrivilege	5084	msdcsc.exe
Token: SeSystemtimePrivilege	5084	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5084	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5084	msdcsc.exe
Token: SeCreatePagefilePrivilege	5084	msdcsc.exe
Token: SeBackupPrivilege	5084	msdcsc.exe
Token: SeRestorePrivilege	5084	msdcsc.exe
Token: SeShutdownPrivilege	5084	msdcsc.exe
Token: SeDebugPrivilege	5084	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5084	msdcsc.exe
Token: SeChangeNotifyPrivilege	5084	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5084	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe186.execmd.execmd.exemsdcsc.execmd.execmd.exemsdcsc.execmd.execmd.exemsdcsc.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 4292 wrote to memory of 4208	4292	192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe	186.exe
PID 4292 wrote to memory of 4208	4292	192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe	186.exe
PID 4292 wrote to memory of 4208	4292	192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe	186.exe
PID 4208 wrote to memory of 4044	4208	186.exe	cmd.exe
PID 4208 wrote to memory of 4044	4208	186.exe	cmd.exe
PID 4208 wrote to memory of 4044	4208	186.exe	cmd.exe
PID 4208 wrote to memory of 396	4208	186.exe	cmd.exe
PID 4208 wrote to memory of 396	4208	186.exe	cmd.exe
PID 4208 wrote to memory of 396	4208	186.exe	cmd.exe
PID 4044 wrote to memory of 2932	4044	cmd.exe	attrib.exe
PID 4044 wrote to memory of 2932	4044	cmd.exe	attrib.exe
PID 4044 wrote to memory of 2932	4044	cmd.exe	attrib.exe
PID 396 wrote to memory of 1212	396	cmd.exe	attrib.exe
PID 396 wrote to memory of 1212	396	cmd.exe	attrib.exe
PID 396 wrote to memory of 1212	396	cmd.exe	attrib.exe
PID 4208 wrote to memory of 1624	4208	186.exe	msdcsc.exe
PID 4208 wrote to memory of 1624	4208	186.exe	msdcsc.exe
PID 4208 wrote to memory of 1624	4208	186.exe	msdcsc.exe
PID 1624 wrote to memory of 4344	1624	msdcsc.exe	cmd.exe
PID 1624 wrote to memory of 4344	1624	msdcsc.exe	cmd.exe
PID 1624 wrote to memory of 4344	1624	msdcsc.exe	cmd.exe
PID 1624 wrote to memory of 4400	1624	msdcsc.exe	cmd.exe
PID 1624 wrote to memory of 4400	1624	msdcsc.exe	cmd.exe
PID 1624 wrote to memory of 4400	1624	msdcsc.exe	cmd.exe
PID 4344 wrote to memory of 1832	4344	cmd.exe	attrib.exe
PID 4344 wrote to memory of 1832	4344	cmd.exe	attrib.exe
PID 4344 wrote to memory of 1832	4344	cmd.exe	attrib.exe
PID 4400 wrote to memory of 2340	4400	cmd.exe	attrib.exe
PID 4400 wrote to memory of 2340	4400	cmd.exe	attrib.exe
PID 4400 wrote to memory of 2340	4400	cmd.exe	attrib.exe
PID 1624 wrote to memory of 5084	1624	msdcsc.exe	msdcsc.exe
PID 1624 wrote to memory of 5084	1624	msdcsc.exe	msdcsc.exe
PID 1624 wrote to memory of 5084	1624	msdcsc.exe	msdcsc.exe
PID 5084 wrote to memory of 3288	5084	msdcsc.exe	cmd.exe
PID 5084 wrote to memory of 3288	5084	msdcsc.exe	cmd.exe
PID 5084 wrote to memory of 3288	5084	msdcsc.exe	cmd.exe
PID 5084 wrote to memory of 3136	5084	msdcsc.exe	cmd.exe
PID 5084 wrote to memory of 3136	5084	msdcsc.exe	cmd.exe
PID 5084 wrote to memory of 3136	5084	msdcsc.exe	cmd.exe
PID 3288 wrote to memory of 2080	3288	cmd.exe	attrib.exe
PID 3288 wrote to memory of 2080	3288	cmd.exe	attrib.exe
PID 3288 wrote to memory of 2080	3288	cmd.exe	attrib.exe
PID 3136 wrote to memory of 1604	3136	cmd.exe	attrib.exe
PID 3136 wrote to memory of 1604	3136	cmd.exe	attrib.exe
PID 3136 wrote to memory of 1604	3136	cmd.exe	attrib.exe
PID 5084 wrote to memory of 4996	5084	msdcsc.exe	msdcsc.exe
PID 5084 wrote to memory of 4996	5084	msdcsc.exe	msdcsc.exe
PID 5084 wrote to memory of 4996	5084	msdcsc.exe	msdcsc.exe
PID 4996 wrote to memory of 1096	4996	msdcsc.exe	cmd.exe
PID 4996 wrote to memory of 1096	4996	msdcsc.exe	cmd.exe
PID 4996 wrote to memory of 1096	4996	msdcsc.exe	cmd.exe
PID 4996 wrote to memory of 4772	4996	msdcsc.exe	cmd.exe
PID 4996 wrote to memory of 4772	4996	msdcsc.exe	cmd.exe
PID 4996 wrote to memory of 4772	4996	msdcsc.exe	cmd.exe
PID 1096 wrote to memory of 4840	1096	cmd.exe	attrib.exe
PID 1096 wrote to memory of 4840	1096	cmd.exe	attrib.exe
PID 1096 wrote to memory of 4840	1096	cmd.exe	attrib.exe
PID 4772 wrote to memory of 2304	4772	cmd.exe	attrib.exe
PID 4772 wrote to memory of 2304	4772	cmd.exe	attrib.exe
PID 4772 wrote to memory of 2304	4772	cmd.exe	attrib.exe
PID 4996 wrote to memory of 2184	4996	msdcsc.exe	msdcsc.exe
PID 4996 wrote to memory of 2184	4996	msdcsc.exe	msdcsc.exe
PID 4996 wrote to memory of 2184	4996	msdcsc.exe	msdcsc.exe
PID 2184 wrote to memory of 3276	2184	msdcsc.exe	cmd.exe

Views/modifies file attributes 1 TTPs 44 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
4840	attrib.exe
4336	attrib.exe
1688	attrib.exe
2676	attrib.exe
5776	attrib.exe
6136	attrib.exe
2932	attrib.exe
2080	attrib.exe
2492	attrib.exe
2184	attrib.exe
1604	attrib.exe
1172	attrib.exe
1212	attrib.exe
1604	attrib.exe
3920	attrib.exe
2064	attrib.exe
6000	attrib.exe
1832	attrib.exe
2304	attrib.exe
2036	attrib.exe
4696	attrib.exe
1680	attrib.exe
5576	attrib.exe
1040	attrib.exe
392	attrib.exe
4052	attrib.exe
5764	attrib.exe
5152	attrib.exe
4760	attrib.exe
5592	attrib.exe
5040	attrib.exe
4760	attrib.exe
3008	attrib.exe
2728	attrib.exe
5284	attrib.exe
5692	attrib.exe
2492	attrib.exe
4516	attrib.exe
5276	attrib.exe
5696	attrib.exe
2340	attrib.exe
4128	attrib.exe
4048	attrib.exe
4168	attrib.exe

C:\Users\Admin\AppData\Local\Temp\192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\192c731e822a64cce6dc9a6725d7b651_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Users\Admin\AppData\Local\Temp\186.exe
C:\Users\Admin\AppData\Local\Temp\186.exe
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\186.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\186.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1212

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:4344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
5⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
5⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2340

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1604

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
6⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
7⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
6⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
7⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2304

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
7⤵
PID:3276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
7⤵
PID:532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2492

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
7⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
8⤵
PID:4668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
8⤵
PID:4500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
9⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:3008

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
8⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
9⤵
PID:4768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
10⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
9⤵
PID:3128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
10⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4696

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
9⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:2404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
10⤵
PID:4976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
10⤵
PID:3628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2492

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
10⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:2072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
11⤵
PID:2848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
11⤵
PID:4192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
12⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4336

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
11⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
12⤵
PID:4392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
12⤵
PID:4936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
13⤵
- Sets file to hidden
- Views/modifies file attributes
PID:392

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
12⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
13⤵
PID:1224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
13⤵
PID:3092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4052

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
13⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
14⤵
PID:3224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
15⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4128

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
14⤵
PID:4364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
15⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2184

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
14⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:3796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
15⤵
PID:2072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
16⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
15⤵
PID:4764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4048

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
15⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:2576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
16⤵
PID:4600

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
17⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2676

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
16⤵
PID:4560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
17⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1604

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
16⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
17⤵
PID:2340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
18⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5276

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
17⤵
PID:3008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
18⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5284

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
17⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
18⤵
PID:5484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
19⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
18⤵
PID:5500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
19⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5776

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
18⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
19⤵
PID:5944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
19⤵
PID:5972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5152

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
19⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
20⤵
PID:5308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
21⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
20⤵
PID:5324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
21⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5696

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
20⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
21⤵
PID:1060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
22⤵
- Sets file to hidden
- Views/modifies file attributes
PID:6000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
21⤵
PID:5792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:6136

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
21⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
22⤵
PID:2880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
22⤵
PID:1392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4760

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
22⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
23⤵
PID:5660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe" +s +h
24⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
23⤵
PID:5284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh" +s +h
24⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5576

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe"
23⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:6024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
24⤵
PID:3576

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh\msdcsc.exe" +s +h
25⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
24⤵
PID:408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\30ibXWq2y5dh" +s +h
25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4760

C:\Windows\SysWOW64\MSDCSC\30ibXWq2y5dh\msdcsc.exe
"C:\Windows\system32\MSDCSC\30ibXWq2y5dh\msdcsc.exe"
24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4356

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\186.exe
Filesize
692KB

MD5
92cebc5cd470ea94f6cf3c228a09f903

SHA1
982e38abbb25f8783569326c9dd2c5e51fb051f9

SHA256
11e73e162c3f6dab132b6d7dd33bae321f30a6a703f9c082a79359c501d2d887

SHA512
62be2cc36bb5bf376b73bbb09c1c2577d98a56bfae844bd6963ca746936209121da05549ca9923793c0318420c8bc4aa3777c8f91d1ca7b055f67319bfc1ea0e

Download Submit
memory/452-444-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1200-754-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1624-135-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2072-568-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2184-320-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2404-506-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2576-878-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3796-816-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4208-14-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4208-8-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/4208-73-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4292-0-0x00007FFC4ED55000-0x00007FFC4ED56000-memory.dmp

Filesize
4KB

Download
memory/4292-10-0x00007FFC4EAA0000-0x00007FFC4F441000-memory.dmp

Filesize
9.6MB

Download
memory/4292-3-0x000000001B6D0000-0x000000001B776000-memory.dmp

Filesize
664KB

Download
memory/4292-2-0x00007FFC4EAA0000-0x00007FFC4F441000-memory.dmp

Filesize
9.6MB

Download
memory/4292-1-0x00007FFC4EAA0000-0x00007FFC4F441000-memory.dmp

Filesize
9.6MB

Download
memory/4368-1312-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4440-630-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4488-382-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4736-692-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4996-258-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5024-940-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5084-196-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5168-1126-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5328-1002-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5640-1188-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5824-1064-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/6024-1374-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/6044-1250-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download