darkcomet | 41e8a5c7267018eeff24f122ff2227e7b7ed2e3dc22338745df631d524502c13

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe
Size

3.2MB
MD5

19fb9afb30fe88d256fdcb2467833578
SHA1

438d3369da71184c31b226f5bf090c8954592ff2
SHA256

41e8a5c7267018eeff24f122ff2227e7b7ed2e3dc22338745df631d524502c13
SHA512

afa881d3600598f87ca6c34f809afe2107e55791dcbf1b59a7e4fa2be093a40423729d7f5a04e1db6748f45c7c5024d9421762996fd9d31edef915032f58d3a0
SSDEEP

24576:oFE//Tct4bOs8JVAzWT3G82PQlIYzuJBCWDlWwy018klgFaVSNucktoZAmK+vo11:aSVn

Score

10^/10

darkcomet evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeSdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	Sdat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

Sets file to hidden 1 TTPs 46 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
2668	attrib.exe
2836	attrib.exe
2808	attrib.exe
1592	attrib.exe
1312	attrib.exe
1556	attrib.exe
1824	attrib.exe
1444	attrib.exe
2532	attrib.exe
1616	attrib.exe
1892	attrib.exe
2228	attrib.exe
2344	attrib.exe
1056	attrib.exe
2068	attrib.exe
2988	attrib.exe
1680	attrib.exe
1616	attrib.exe
2832	attrib.exe
2660	attrib.exe
1792	attrib.exe
1724	attrib.exe
2824	attrib.exe
1672	attrib.exe
2668	attrib.exe
1672	attrib.exe
2632	attrib.exe
1700	attrib.exe
2360	attrib.exe
1872	attrib.exe
1440	attrib.exe
2604	attrib.exe
1540	attrib.exe
2712	attrib.exe
1420	attrib.exe
896	attrib.exe
2668	attrib.exe
1108	attrib.exe
1764	attrib.exe
1548	attrib.exe
1092	attrib.exe
380	attrib.exe
760	attrib.exe
1264	attrib.exe
2972	attrib.exe
2828	attrib.exe

Executes dropped EXE 24 IoCs

Processes:

Sdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid	process
2308	Sdat.exe
2580	svchost.exe
2996	svchost.exe
2440	svchost.exe
3036	svchost.exe
2436	svchost.exe
1700	svchost.exe
1740	svchost.exe
3040	svchost.exe
2108	svchost.exe
2764	svchost.exe
2552	svchost.exe
988	svchost.exe
756	svchost.exe
2208	svchost.exe
2864	svchost.exe
1472	svchost.exe
1824	svchost.exe
2888	svchost.exe
636	svchost.exe
1540	svchost.exe
932	svchost.exe
2224	svchost.exe
1084	svchost.exe

Loads dropped DLL 48 IoCs

Processes:

19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exeSdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid	process
824	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe
824	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe
2308	Sdat.exe
2308	Sdat.exe
2580	svchost.exe
2580	svchost.exe
2996	svchost.exe
2996	svchost.exe
2440	svchost.exe
2440	svchost.exe
3036	svchost.exe
3036	svchost.exe
2436	svchost.exe
2436	svchost.exe
1700	svchost.exe
1700	svchost.exe
1740	svchost.exe
1740	svchost.exe
3040	svchost.exe
3040	svchost.exe
2108	svchost.exe
2108	svchost.exe
2764	svchost.exe
2764	svchost.exe
2552	svchost.exe
2552	svchost.exe
988	svchost.exe
988	svchost.exe
756	svchost.exe
756	svchost.exe
2208	svchost.exe
2208	svchost.exe
2864	svchost.exe
2864	svchost.exe
1472	svchost.exe
1472	svchost.exe
1824	svchost.exe
1824	svchost.exe
2888	svchost.exe
2888	svchost.exe
636	svchost.exe
636	svchost.exe
1540	svchost.exe
1540	svchost.exe
932	svchost.exe
932	svchost.exe
2224	svchost.exe
2224	svchost.exe

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/824-0-0x0000000000400000-0x00000000004BB000-memory.dmp upx
behavioral1/memory/824-10-0x0000000000400000-0x00000000004BB000-memory.dmp upx

resource	yara_rule
behavioral1/memory/824-0-0x0000000000400000-0x00000000004BB000-memory.dmp	upx
behavioral1/memory/824-10-0x0000000000400000-0x00000000004BB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeSdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	Sdat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

behavioral1/memory/824-10-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe

resource	yara_rule
behavioral1/memory/824-10-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe

Drops file in System32 directory 64 IoCs

Processes:

svchost.exesvchost.exeattrib.exeattrib.exesvchost.exeattrib.exeattrib.exeattrib.exeattrib.exesvchost.exeattrib.exesvchost.exesvchost.exeattrib.exesvchost.exeattrib.exeSdat.exeattrib.exesvchost.exeattrib.exesvchost.exesvchost.exesvchost.exesvchost.exeattrib.exesvchost.exesvchost.exesvchost.exeattrib.exeattrib.exesvchost.exeattrib.exeattrib.exeattrib.exesvchost.exeattrib.exeattrib.exesvchost.exeattrib.exesvchost.exesvchost.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	Sdat.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	Sdat.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 23 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
2168	PING.EXE
1592	PING.EXE
2820	PING.EXE
1864	PING.EXE
2944	PING.EXE
1420	PING.EXE
2864	PING.EXE
2916	PING.EXE
900	PING.EXE
1956	PING.EXE
3036	PING.EXE
2912	PING.EXE
2788	PING.EXE
3064	PING.EXE
1556	PING.EXE
1444	PING.EXE
2876	PING.EXE
1264	PING.EXE
1296	PING.EXE
2148	PING.EXE
1444	PING.EXE
1676	PING.EXE
2592	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sdat.exesvchost.exesvchost.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2308	Sdat.exe
Token: SeSecurityPrivilege	2308	Sdat.exe
Token: SeTakeOwnershipPrivilege	2308	Sdat.exe
Token: SeLoadDriverPrivilege	2308	Sdat.exe
Token: SeSystemProfilePrivilege	2308	Sdat.exe
Token: SeSystemtimePrivilege	2308	Sdat.exe
Token: SeProfSingleProcessPrivilege	2308	Sdat.exe
Token: SeIncBasePriorityPrivilege	2308	Sdat.exe
Token: SeCreatePagefilePrivilege	2308	Sdat.exe
Token: SeBackupPrivilege	2308	Sdat.exe
Token: SeRestorePrivilege	2308	Sdat.exe
Token: SeShutdownPrivilege	2308	Sdat.exe
Token: SeDebugPrivilege	2308	Sdat.exe
Token: SeSystemEnvironmentPrivilege	2308	Sdat.exe
Token: SeChangeNotifyPrivilege	2308	Sdat.exe
Token: SeRemoteShutdownPrivilege	2308	Sdat.exe
Token: SeUndockPrivilege	2308	Sdat.exe
Token: SeManageVolumePrivilege	2308	Sdat.exe
Token: SeImpersonatePrivilege	2308	Sdat.exe
Token: SeCreateGlobalPrivilege	2308	Sdat.exe
Token: 33	2308	Sdat.exe
Token: 34	2308	Sdat.exe
Token: 35	2308	Sdat.exe
Token: SeIncreaseQuotaPrivilege	2580	svchost.exe
Token: SeSecurityPrivilege	2580	svchost.exe
Token: SeTakeOwnershipPrivilege	2580	svchost.exe
Token: SeLoadDriverPrivilege	2580	svchost.exe
Token: SeSystemProfilePrivilege	2580	svchost.exe
Token: SeSystemtimePrivilege	2580	svchost.exe
Token: SeProfSingleProcessPrivilege	2580	svchost.exe
Token: SeIncBasePriorityPrivilege	2580	svchost.exe
Token: SeCreatePagefilePrivilege	2580	svchost.exe
Token: SeBackupPrivilege	2580	svchost.exe
Token: SeRestorePrivilege	2580	svchost.exe
Token: SeShutdownPrivilege	2580	svchost.exe
Token: SeDebugPrivilege	2580	svchost.exe
Token: SeSystemEnvironmentPrivilege	2580	svchost.exe
Token: SeChangeNotifyPrivilege	2580	svchost.exe
Token: SeRemoteShutdownPrivilege	2580	svchost.exe
Token: SeUndockPrivilege	2580	svchost.exe
Token: SeManageVolumePrivilege	2580	svchost.exe
Token: SeImpersonatePrivilege	2580	svchost.exe
Token: SeCreateGlobalPrivilege	2580	svchost.exe
Token: 33	2580	svchost.exe
Token: 34	2580	svchost.exe
Token: 35	2580	svchost.exe
Token: SeIncreaseQuotaPrivilege	2996	svchost.exe
Token: SeSecurityPrivilege	2996	svchost.exe
Token: SeTakeOwnershipPrivilege	2996	svchost.exe
Token: SeLoadDriverPrivilege	2996	svchost.exe
Token: SeSystemProfilePrivilege	2996	svchost.exe
Token: SeSystemtimePrivilege	2996	svchost.exe
Token: SeProfSingleProcessPrivilege	2996	svchost.exe
Token: SeIncBasePriorityPrivilege	2996	svchost.exe
Token: SeCreatePagefilePrivilege	2996	svchost.exe
Token: SeBackupPrivilege	2996	svchost.exe
Token: SeRestorePrivilege	2996	svchost.exe
Token: SeShutdownPrivilege	2996	svchost.exe
Token: SeDebugPrivilege	2996	svchost.exe
Token: SeSystemEnvironmentPrivilege	2996	svchost.exe
Token: SeChangeNotifyPrivilege	2996	svchost.exe
Token: SeRemoteShutdownPrivilege	2996	svchost.exe
Token: SeUndockPrivilege	2996	svchost.exe
Token: SeManageVolumePrivilege	2996	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exeSdat.execmd.execmd.execmd.exesvchost.execmd.execmd.execmd.exesvchost.exe

description	pid	process	target process
PID 824 wrote to memory of 2308	824	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 824 wrote to memory of 2308	824	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 824 wrote to memory of 2308	824	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 824 wrote to memory of 2308	824	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 2308 wrote to memory of 2544	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2544	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2544	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2544	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2784	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2784	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2784	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2784	2308	Sdat.exe	cmd.exe
PID 2544 wrote to memory of 2660	2544	cmd.exe	attrib.exe
PID 2544 wrote to memory of 2660	2544	cmd.exe	attrib.exe
PID 2544 wrote to memory of 2660	2544	cmd.exe	attrib.exe
PID 2544 wrote to memory of 2660	2544	cmd.exe	attrib.exe
PID 2784 wrote to memory of 2604	2784	cmd.exe	attrib.exe
PID 2784 wrote to memory of 2604	2784	cmd.exe	attrib.exe
PID 2784 wrote to memory of 2604	2784	cmd.exe	attrib.exe
PID 2784 wrote to memory of 2604	2784	cmd.exe	attrib.exe
PID 2308 wrote to memory of 2580	2308	Sdat.exe	svchost.exe
PID 2308 wrote to memory of 2580	2308	Sdat.exe	svchost.exe
PID 2308 wrote to memory of 2580	2308	Sdat.exe	svchost.exe
PID 2308 wrote to memory of 2580	2308	Sdat.exe	svchost.exe
PID 2308 wrote to memory of 2728	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2728	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2728	2308	Sdat.exe	cmd.exe
PID 2308 wrote to memory of 2728	2308	Sdat.exe	cmd.exe
PID 2728 wrote to memory of 2788	2728	cmd.exe	PING.EXE
PID 2728 wrote to memory of 2788	2728	cmd.exe	PING.EXE
PID 2728 wrote to memory of 2788	2728	cmd.exe	PING.EXE
PID 2728 wrote to memory of 2788	2728	cmd.exe	PING.EXE
PID 2580 wrote to memory of 2700	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2700	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2700	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2700	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2448	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2448	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2448	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2448	2580	svchost.exe	cmd.exe
PID 2700 wrote to memory of 1616	2700	cmd.exe	attrib.exe
PID 2700 wrote to memory of 1616	2700	cmd.exe	attrib.exe
PID 2700 wrote to memory of 1616	2700	cmd.exe	attrib.exe
PID 2700 wrote to memory of 1616	2700	cmd.exe	attrib.exe
PID 2448 wrote to memory of 2828	2448	cmd.exe	attrib.exe
PID 2448 wrote to memory of 2828	2448	cmd.exe	attrib.exe
PID 2448 wrote to memory of 2828	2448	cmd.exe	attrib.exe
PID 2448 wrote to memory of 2828	2448	cmd.exe	attrib.exe
PID 2580 wrote to memory of 2996	2580	svchost.exe	svchost.exe
PID 2580 wrote to memory of 2996	2580	svchost.exe	svchost.exe
PID 2580 wrote to memory of 2996	2580	svchost.exe	svchost.exe
PID 2580 wrote to memory of 2996	2580	svchost.exe	svchost.exe
PID 2580 wrote to memory of 2244	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2244	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2244	2580	svchost.exe	cmd.exe
PID 2580 wrote to memory of 2244	2580	svchost.exe	cmd.exe
PID 2244 wrote to memory of 2168	2244	cmd.exe	PING.EXE
PID 2244 wrote to memory of 2168	2244	cmd.exe	PING.EXE
PID 2244 wrote to memory of 2168	2244	cmd.exe	PING.EXE
PID 2244 wrote to memory of 2168	2244	cmd.exe	PING.EXE
PID 2996 wrote to memory of 1984	2996	svchost.exe	cmd.exe
PID 2996 wrote to memory of 1984	2996	svchost.exe	cmd.exe
PID 2996 wrote to memory of 1984	2996	svchost.exe	cmd.exe
PID 2996 wrote to memory of 1984	2996	svchost.exe	cmd.exe

Views/modifies file attributes 1 TTPs 46 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
2532	attrib.exe
2988	attrib.exe
1420	attrib.exe
2360	attrib.exe
2824	attrib.exe
1556	attrib.exe
1616	attrib.exe
2836	attrib.exe
2344	attrib.exe
2660	attrib.exe
2808	attrib.exe
1056	attrib.exe
1700	attrib.exe
1872	attrib.exe
1444	attrib.exe
1548	attrib.exe
2668	attrib.exe
2972	attrib.exe
2632	attrib.exe
2228	attrib.exe
2832	attrib.exe
1672	attrib.exe
1312	attrib.exe
2712	attrib.exe
1824	attrib.exe
1108	attrib.exe
1440	attrib.exe
1616	attrib.exe
380	attrib.exe
1680	attrib.exe
896	attrib.exe
2668	attrib.exe
1764	attrib.exe
1672	attrib.exe
1892	attrib.exe
1792	attrib.exe
1724	attrib.exe
760	attrib.exe
1592	attrib.exe
2668	attrib.exe
1540	attrib.exe
1264	attrib.exe
1092	attrib.exe
2604	attrib.exe
2828	attrib.exe
2068	attrib.exe

C:\Users\Admin\AppData\Local\Temp\19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Roaming\Sdat.exe
C:\Users\Admin\AppData\Roaming\Sdat.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Sdat.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Roaming\Sdat.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Roaming" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2604

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
5⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2828

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
5⤵
PID:1984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
5⤵
PID:1584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2808

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
6⤵
PID:1516

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
7⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
6⤵
PID:1532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
7⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2068

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
7⤵
PID:1136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
8⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
7⤵
PID:392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:380

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
8⤵
PID:1048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
8⤵
PID:2416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1792

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
9⤵
PID:1080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
10⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
9⤵
PID:576

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
10⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1056

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
10⤵
PID:2172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
10⤵
PID:2192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1724

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
11⤵
PID:2880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
11⤵
PID:2624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
12⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2712

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
11⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
12⤵
PID:2796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
12⤵
PID:2808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
13⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2632

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
13⤵
PID:2688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
13⤵
PID:3016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
14⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1264

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
14⤵
PID:2324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
15⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
14⤵
PID:2140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
15⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1556

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
14⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
15⤵
PID:1208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
15⤵
PID:2948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
16⤵
- Sets file to hidden
- Views/modifies file attributes
PID:896

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
16⤵
PID:1900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
17⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
16⤵
PID:2692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
17⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2668

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
16⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
17⤵
PID:1588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
17⤵
PID:2744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1108

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
17⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
18⤵
PID:1264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
19⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2836

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
18⤵
PID:2028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
19⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2228

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
19⤵
PID:1184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
20⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
19⤵
PID:1536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1700

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
19⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
20⤵
PID:3064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
21⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
20⤵
PID:2824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
21⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1764

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
20⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
21⤵
PID:2748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
22⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
21⤵
PID:968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1872

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
22⤵
PID:1220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
22⤵
PID:768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
23⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1672

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
23⤵
PID:2732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
24⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
23⤵
PID:2724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
24⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2344

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
23⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
24⤵
PID:2888

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
24⤵
PID:1104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1892

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
25⤵
PID:988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
26⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
25⤵
PID:2460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
26⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1092

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
25⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
25⤵
PID:1540

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
26⤵
- Runs ping.exe
PID:1444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
24⤵
PID:2648

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
25⤵
- Runs ping.exe
PID:1864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
23⤵
PID:2536

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
24⤵
- Runs ping.exe
PID:2876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
22⤵
PID:844

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
23⤵
- Runs ping.exe
PID:2592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
21⤵
PID:1592

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
22⤵
- Runs ping.exe
PID:1420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
20⤵
PID:2176

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
21⤵
- Runs ping.exe
PID:2820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
19⤵
PID:2340

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
20⤵
- Runs ping.exe
PID:1676

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
18⤵
PID:2132

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
19⤵
- Runs ping.exe
PID:1556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
17⤵
PID:1648

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
18⤵
- Runs ping.exe
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
16⤵
PID:2524

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
17⤵
- Runs ping.exe
PID:2944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
15⤵
PID:1724

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
16⤵
- Runs ping.exe
PID:3064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
14⤵
PID:1188

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
15⤵
- Runs ping.exe
PID:2912

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
13⤵
PID:588

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
14⤵
- Runs ping.exe
PID:3036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
12⤵
PID:2848

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
13⤵
- Runs ping.exe
PID:1444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
11⤵
PID:2564

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
12⤵
- Runs ping.exe
PID:2148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
10⤵
PID:2672

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
11⤵
- Runs ping.exe
PID:1956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
9⤵
PID:2284

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
10⤵
- Runs ping.exe
PID:900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
8⤵
PID:1204

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
9⤵
- Runs ping.exe
PID:2916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
7⤵
PID:992

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
8⤵
- Runs ping.exe
PID:1296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
6⤵
PID:3024

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
7⤵
- Runs ping.exe
PID:1264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
5⤵
PID:2628

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
6⤵
- Runs ping.exe
PID:2864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
5⤵
- Runs ping.exe
PID:2168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Roaming\Sdat.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:2788

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Sdat.exe
Filesize
747KB

MD5
87ce1b80fd2506e327c5d75efb1c8101

SHA1
58af872a21a2492b1407aae7b3e7b55ddb9083c6

SHA256
fb6dcc691683d7d1d583237e5f33cd91111bbde25f546b93756299c4c734e092

SHA512
fe8cb2a07e3f5d635f6c16984f2efe36917e8deb283cbbdac0174af5f5dcd2cd91b1e4d928b695bfd1feda7bf4252a378b65f77ce8a1c217adf7d8ba556c20c5

Download Submit
memory/636-97-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/756-81-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/824-10-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/824-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/932-99-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/988-77-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1472-91-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1540-98-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1700-51-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1740-54-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1824-92-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-63-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2208-86-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2224-100-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2308-24-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2308-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2436-46-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2440-37-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2552-73-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2580-29-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2764-68-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2864-90-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2888-94-0x0000000077A50000-0x0000000077B6F000-memory.dmp

Filesize
1.1MB

Download
memory/2888-93-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2888-96-0x0000000003270000-0x00000000033CC000-memory.dmp

Filesize
1.4MB

Download
memory/2888-95-0x0000000077B70000-0x0000000077C6A000-memory.dmp

Filesize
1000KB

Download
memory/2996-34-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3036-42-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3040-59-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads