darkcomet | 41e8a5c7267018eeff24f122ff2227e7b7ed2e3dc22338745df631d524502c13

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe
Size

3.2MB
MD5

19fb9afb30fe88d256fdcb2467833578
SHA1

438d3369da71184c31b226f5bf090c8954592ff2
SHA256

41e8a5c7267018eeff24f122ff2227e7b7ed2e3dc22338745df631d524502c13
SHA512

afa881d3600598f87ca6c34f809afe2107e55791dcbf1b59a7e4fa2be093a40423729d7f5a04e1db6748f45c7c5024d9421762996fd9d31edef915032f58d3a0
SSDEEP

24576:oFE//Tct4bOs8JVAzWT3G82PQlIYzuJBCWDlWwy018klgFaVSNucktoZAmK+vo11:aSVn

Score

10^/10

darkcomet evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeSdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	Sdat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

Sets file to hidden 1 TTPs 48 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
5428	attrib.exe
5420	attrib.exe
6076	attrib.exe
2492	attrib.exe
2436	attrib.exe
4692	attrib.exe
2440	attrib.exe
1432	attrib.exe
5584	attrib.exe
5568	attrib.exe
904	attrib.exe
6100	attrib.exe
5320	attrib.exe
5300	attrib.exe
1752	attrib.exe
2504	attrib.exe
1124	attrib.exe
1164	attrib.exe
5828	attrib.exe
4988	attrib.exe
4704	attrib.exe
2260	attrib.exe
3976	attrib.exe
4444	attrib.exe
5844	attrib.exe
3428	attrib.exe
440	attrib.exe
1248	attrib.exe
2820	attrib.exe
4968	attrib.exe
3032	attrib.exe
1088	attrib.exe
4200	attrib.exe
1808	attrib.exe
5628	attrib.exe
5052	attrib.exe
1932	attrib.exe
4824	attrib.exe
3096	attrib.exe
4200	attrib.exe
5948	attrib.exe
4988	attrib.exe
6104	attrib.exe
4808	attrib.exe
1572	attrib.exe
1508	attrib.exe
4392	attrib.exe
5308	attrib.exe

Checks computer location settings 2 TTPs 24 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeSdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Sdat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 24 IoCs

Processes:

Sdat.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid	process
2272	Sdat.exe
3116	svchost.exe
932	svchost.exe
4884	svchost.exe
4604	svchost.exe
2492	svchost.exe
4872	svchost.exe
1652	svchost.exe
3956	svchost.exe
1660	svchost.exe
3116	svchost.exe
1512	svchost.exe
444	svchost.exe
1512	svchost.exe
1152	svchost.exe
4208	svchost.exe
5444	svchost.exe
5860	svchost.exe
6116	svchost.exe
708	svchost.exe
5548	svchost.exe
388	svchost.exe
5616	svchost.exe
5524	svchost.exe

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral2/memory/4988-0-0x0000000000400000-0x00000000004BB000-memory.dmp upx
behavioral2/memory/4988-6-0x0000000000400000-0x00000000004BB000-memory.dmp upx

resource	yara_rule
behavioral2/memory/4988-0-0x0000000000400000-0x00000000004BB000-memory.dmp	upx
behavioral2/memory/4988-6-0x0000000000400000-0x00000000004BB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeSdat.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	Sdat.exe

AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

behavioral2/memory/4988-6-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe

resource	yara_rule
behavioral2/memory/4988-6-0x0000000000400000-0x00000000004BB000-memory.dmp	autoit_exe

Drops file in System32 directory 64 IoCs

Processes:

svchost.exesvchost.exesvchost.exeattrib.exeattrib.exesvchost.exesvchost.exeattrib.exeSdat.exeattrib.exeattrib.exesvchost.exeattrib.exesvchost.exesvchost.exesvchost.exesvchost.exeattrib.exeattrib.exesvchost.exeattrib.exesvchost.exesvchost.exesvchost.exeattrib.exesvchost.exeattrib.exeattrib.exesvchost.exeattrib.exesvchost.exeattrib.exesvchost.exesvchost.exeattrib.exeattrib.exeattrib.exeattrib.exesvchost.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	Sdat.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 23 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeSdat.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Sdat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

Runs ping.exe 1 TTPs 23 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
3308	PING.EXE
4680	PING.EXE
2188	PING.EXE
4680	PING.EXE
4688	PING.EXE
5108	PING.EXE
2260	PING.EXE
3424	PING.EXE
8	PING.EXE
4136	PING.EXE
2260	PING.EXE
5520	PING.EXE
5280	PING.EXE
3032	PING.EXE
1652	PING.EXE
2892	PING.EXE
992	PING.EXE
5076	PING.EXE
4756	PING.EXE
5928	PING.EXE
5872	PING.EXE
3936	PING.EXE
4856	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sdat.exesvchost.exesvchost.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2272	Sdat.exe
Token: SeSecurityPrivilege	2272	Sdat.exe
Token: SeTakeOwnershipPrivilege	2272	Sdat.exe
Token: SeLoadDriverPrivilege	2272	Sdat.exe
Token: SeSystemProfilePrivilege	2272	Sdat.exe
Token: SeSystemtimePrivilege	2272	Sdat.exe
Token: SeProfSingleProcessPrivilege	2272	Sdat.exe
Token: SeIncBasePriorityPrivilege	2272	Sdat.exe
Token: SeCreatePagefilePrivilege	2272	Sdat.exe
Token: SeBackupPrivilege	2272	Sdat.exe
Token: SeRestorePrivilege	2272	Sdat.exe
Token: SeShutdownPrivilege	2272	Sdat.exe
Token: SeDebugPrivilege	2272	Sdat.exe
Token: SeSystemEnvironmentPrivilege	2272	Sdat.exe
Token: SeChangeNotifyPrivilege	2272	Sdat.exe
Token: SeRemoteShutdownPrivilege	2272	Sdat.exe
Token: SeUndockPrivilege	2272	Sdat.exe
Token: SeManageVolumePrivilege	2272	Sdat.exe
Token: SeImpersonatePrivilege	2272	Sdat.exe
Token: SeCreateGlobalPrivilege	2272	Sdat.exe
Token: 33	2272	Sdat.exe
Token: 34	2272	Sdat.exe
Token: 35	2272	Sdat.exe
Token: 36	2272	Sdat.exe
Token: SeIncreaseQuotaPrivilege	3116	svchost.exe
Token: SeSecurityPrivilege	3116	svchost.exe
Token: SeTakeOwnershipPrivilege	3116	svchost.exe
Token: SeLoadDriverPrivilege	3116	svchost.exe
Token: SeSystemProfilePrivilege	3116	svchost.exe
Token: SeSystemtimePrivilege	3116	svchost.exe
Token: SeProfSingleProcessPrivilege	3116	svchost.exe
Token: SeIncBasePriorityPrivilege	3116	svchost.exe
Token: SeCreatePagefilePrivilege	3116	svchost.exe
Token: SeBackupPrivilege	3116	svchost.exe
Token: SeRestorePrivilege	3116	svchost.exe
Token: SeShutdownPrivilege	3116	svchost.exe
Token: SeDebugPrivilege	3116	svchost.exe
Token: SeSystemEnvironmentPrivilege	3116	svchost.exe
Token: SeChangeNotifyPrivilege	3116	svchost.exe
Token: SeRemoteShutdownPrivilege	3116	svchost.exe
Token: SeUndockPrivilege	3116	svchost.exe
Token: SeManageVolumePrivilege	3116	svchost.exe
Token: SeImpersonatePrivilege	3116	svchost.exe
Token: SeCreateGlobalPrivilege	3116	svchost.exe
Token: 33	3116	svchost.exe
Token: 34	3116	svchost.exe
Token: 35	3116	svchost.exe
Token: 36	3116	svchost.exe
Token: SeIncreaseQuotaPrivilege	4884	svchost.exe
Token: SeSecurityPrivilege	4884	svchost.exe
Token: SeTakeOwnershipPrivilege	4884	svchost.exe
Token: SeLoadDriverPrivilege	4884	svchost.exe
Token: SeSystemProfilePrivilege	4884	svchost.exe
Token: SeSystemtimePrivilege	4884	svchost.exe
Token: SeProfSingleProcessPrivilege	4884	svchost.exe
Token: SeIncBasePriorityPrivilege	4884	svchost.exe
Token: SeCreatePagefilePrivilege	4884	svchost.exe
Token: SeBackupPrivilege	4884	svchost.exe
Token: SeRestorePrivilege	4884	svchost.exe
Token: SeShutdownPrivilege	4884	svchost.exe
Token: SeDebugPrivilege	4884	svchost.exe
Token: SeSystemEnvironmentPrivilege	4884	svchost.exe
Token: SeChangeNotifyPrivilege	4884	svchost.exe
Token: SeRemoteShutdownPrivilege	4884	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exeSdat.execmd.execmd.execmd.exesvchost.execmd.execmd.execmd.execmd.execmd.execmd.exesvchost.execmd.execmd.exe

description	pid	process	target process
PID 4988 wrote to memory of 2272	4988	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 4988 wrote to memory of 2272	4988	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 4988 wrote to memory of 2272	4988	19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe	Sdat.exe
PID 2272 wrote to memory of 3644	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 3644	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 3644	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 812	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 812	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 812	2272	Sdat.exe	cmd.exe
PID 3644 wrote to memory of 4808	3644	cmd.exe	attrib.exe
PID 3644 wrote to memory of 4808	3644	cmd.exe	attrib.exe
PID 3644 wrote to memory of 4808	3644	cmd.exe	attrib.exe
PID 812 wrote to memory of 1932	812	cmd.exe	attrib.exe
PID 812 wrote to memory of 1932	812	cmd.exe	attrib.exe
PID 812 wrote to memory of 1932	812	cmd.exe	attrib.exe
PID 2272 wrote to memory of 3116	2272	Sdat.exe	svchost.exe
PID 2272 wrote to memory of 3116	2272	Sdat.exe	svchost.exe
PID 2272 wrote to memory of 3116	2272	Sdat.exe	svchost.exe
PID 2272 wrote to memory of 864	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 864	2272	Sdat.exe	cmd.exe
PID 2272 wrote to memory of 864	2272	Sdat.exe	cmd.exe
PID 864 wrote to memory of 4856	864	cmd.exe	PING.EXE
PID 864 wrote to memory of 4856	864	cmd.exe	PING.EXE
PID 864 wrote to memory of 4856	864	cmd.exe	PING.EXE
PID 3116 wrote to memory of 4932	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 4932	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 4932	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 2124	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 2124	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 2124	3116	svchost.exe	cmd.exe
PID 4932 wrote to memory of 4704	4932	cmd.exe	attrib.exe
PID 4932 wrote to memory of 4704	4932	cmd.exe	attrib.exe
PID 4932 wrote to memory of 4704	4932	cmd.exe	attrib.exe
PID 2124 wrote to memory of 2492	2124	cmd.exe	attrib.exe
PID 2124 wrote to memory of 2492	2124	cmd.exe	attrib.exe
PID 2124 wrote to memory of 2492	2124	cmd.exe	attrib.exe
PID 3116 wrote to memory of 932	3116	svchost.exe	svchost.exe
PID 3116 wrote to memory of 932	3116	svchost.exe	svchost.exe
PID 3116 wrote to memory of 932	3116	svchost.exe	svchost.exe
PID 3116 wrote to memory of 3104	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 3104	3116	svchost.exe	cmd.exe
PID 3116 wrote to memory of 3104	3116	svchost.exe	cmd.exe
PID 3104 wrote to memory of 1652	3104	cmd.exe	PING.EXE
PID 3104 wrote to memory of 1652	3104	cmd.exe	PING.EXE
PID 3104 wrote to memory of 1652	3104	cmd.exe	PING.EXE
PID 3872 wrote to memory of 1572	3872	cmd.exe	attrib.exe
PID 3872 wrote to memory of 1572	3872	cmd.exe	attrib.exe
PID 3872 wrote to memory of 1572	3872	cmd.exe	attrib.exe
PID 1128 wrote to memory of 2436	1128	cmd.exe	attrib.exe
PID 1128 wrote to memory of 2436	1128	cmd.exe	attrib.exe
PID 1128 wrote to memory of 2436	1128	cmd.exe	attrib.exe
PID 3396 wrote to memory of 4680	3396	cmd.exe	PING.EXE
PID 3396 wrote to memory of 4680	3396	cmd.exe	PING.EXE
PID 3396 wrote to memory of 4680	3396	cmd.exe	PING.EXE
PID 4884 wrote to memory of 4896	4884	svchost.exe	cmd.exe
PID 4884 wrote to memory of 4896	4884	svchost.exe	cmd.exe
PID 4884 wrote to memory of 4896	4884	svchost.exe	cmd.exe
PID 4884 wrote to memory of 3668	4884	svchost.exe	cmd.exe
PID 4884 wrote to memory of 3668	4884	svchost.exe	cmd.exe
PID 4884 wrote to memory of 3668	4884	svchost.exe	cmd.exe
PID 4896 wrote to memory of 1248	4896	cmd.exe	attrib.exe
PID 4896 wrote to memory of 1248	4896	cmd.exe	attrib.exe
PID 4896 wrote to memory of 1248	4896	cmd.exe	attrib.exe
PID 3668 wrote to memory of 1752	3668	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 48 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
4704	attrib.exe
3428	attrib.exe
4808	attrib.exe
2436	attrib.exe
1164	attrib.exe
3096	attrib.exe
440	attrib.exe
1432	attrib.exe
5828	attrib.exe
1932	attrib.exe
1124	attrib.exe
3032	attrib.exe
1088	attrib.exe
4444	attrib.exe
1808	attrib.exe
5420	attrib.exe
6076	attrib.exe
904	attrib.exe
5584	attrib.exe
5300	attrib.exe
5052	attrib.exe
6100	attrib.exe
5320	attrib.exe
4824	attrib.exe
2260	attrib.exe
2820	attrib.exe
2504	attrib.exe
4392	attrib.exe
5428	attrib.exe
5568	attrib.exe
4200	attrib.exe
1248	attrib.exe
1508	attrib.exe
4200	attrib.exe
5308	attrib.exe
5628	attrib.exe
5948	attrib.exe
4988	attrib.exe
6104	attrib.exe
1752	attrib.exe
1572	attrib.exe
4692	attrib.exe
2440	attrib.exe
2492	attrib.exe
4968	attrib.exe
5844	attrib.exe
4988	attrib.exe
3976	attrib.exe

C:\Users\Admin\AppData\Local\Temp\19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19fb9afb30fe88d256fdcb2467833578_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Roaming\Sdat.exe
C:\Users\Admin\AppData\Roaming\Sdat.exe
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Sdat.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Roaming\Sdat.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Roaming" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1932

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:4932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
5⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4704

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2492

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1572

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
6⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
7⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1248

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
6⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
7⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1752

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
7⤵
PID:2932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
8⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
7⤵
PID:3520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
8⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4692

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
7⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:2492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
8⤵
PID:400

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
8⤵
PID:5036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2440

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
8⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
9⤵
PID:2952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
10⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
9⤵
PID:4604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
10⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1508

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
9⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
10⤵
PID:4688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
11⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
10⤵
PID:1620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4200

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
10⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:3956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
11⤵
PID:1420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
11⤵
PID:1508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4968

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
11⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
12⤵
PID:3792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
12⤵
PID:992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1124

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
12⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:3116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
13⤵
PID:4472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
14⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
13⤵
PID:2564

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
14⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3032

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
13⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
14⤵
PID:3132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
15⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
14⤵
PID:3392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
15⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:3096

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
14⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
15⤵
PID:4164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
16⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
15⤵
PID:3808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4444

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
15⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
16⤵
PID:1756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
17⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
16⤵
PID:4528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
17⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1432

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
16⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
17⤵
PID:996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
17⤵
PID:2488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
18⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1808

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
17⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
18⤵
PID:5328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
19⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
18⤵
PID:5336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
19⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5428

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
18⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
19⤵
PID:5740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
20⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
19⤵
PID:5768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5844

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
19⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5860

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
20⤵
PID:5996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
21⤵
- Sets file to hidden
- Views/modifies file attributes
PID:6076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
20⤵
PID:6024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
21⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:6100

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
20⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
21⤵
PID:2448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
22⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
21⤵
PID:3896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5320

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
21⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
22⤵
PID:5604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
22⤵
PID:5652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
23⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5584

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
22⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
23⤵
PID:5464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
24⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
23⤵
PID:5736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
24⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5948

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
23⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
24⤵
PID:5268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
24⤵
PID:1224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
25⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5300

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
24⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:5616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
25⤵
PID:2128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
26⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
25⤵
PID:5516

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
26⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5052

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
25⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
26⤵
PID:372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
27⤵
- Sets file to hidden
- Views/modifies file attributes
PID:6104

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
26⤵
PID:5476

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\svchost" +s +h
27⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4200

C:\Windows\SysWOW64\svchost\svchost.exe
"C:\Windows\system32\svchost\svchost.exe"
26⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
26⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
25⤵
PID:5544

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
26⤵
- Runs ping.exe
PID:3936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
24⤵
PID:5216

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
25⤵
- Runs ping.exe
PID:2188

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
23⤵
PID:6008

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
24⤵
- Runs ping.exe
PID:5872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
22⤵
PID:5700

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
23⤵
- Runs ping.exe
PID:3032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
21⤵
PID:5452

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
22⤵
- Runs ping.exe
PID:5280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
20⤵
PID:6128

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
21⤵
- Runs ping.exe
PID:2260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
19⤵
PID:5880

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
20⤵
- Runs ping.exe
PID:5928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
18⤵
PID:5456

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
19⤵
- Runs ping.exe
PID:5520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
17⤵
PID:4372

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
18⤵
- Runs ping.exe
PID:2260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
16⤵
PID:4808

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
17⤵
- Runs ping.exe
PID:4680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
15⤵
PID:1412

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
16⤵
- Runs ping.exe
PID:5108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
14⤵
PID:3980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
15⤵
- Runs ping.exe
PID:4136

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
13⤵
PID:904

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
14⤵
- Runs ping.exe
PID:8

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
12⤵
PID:4104

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
13⤵
- Runs ping.exe
PID:4756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
11⤵
PID:2772

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
12⤵
- Runs ping.exe
PID:5076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
10⤵
PID:1120

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
11⤵
- Runs ping.exe
PID:992

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
9⤵
PID:2728

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
10⤵
- Runs ping.exe
PID:2892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
8⤵
PID:1280

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
9⤵
- Runs ping.exe
PID:3308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
7⤵
PID:2604

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
8⤵
- Runs ping.exe
PID:4688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
6⤵
PID:1696

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
7⤵
- Runs ping.exe
PID:3424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:3396

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
6⤵
- Runs ping.exe
PID:4680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
5⤵
- Runs ping.exe
PID:1652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Roaming\Sdat.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sdat.exe
Filesize
747KB

MD5
87ce1b80fd2506e327c5d75efb1c8101

SHA1
58af872a21a2492b1407aae7b3e7b55ddb9083c6

SHA256
fb6dcc691683d7d1d583237e5f33cd91111bbde25f546b93756299c4c734e092

SHA512
fe8cb2a07e3f5d635f6c16984f2efe36917e8deb283cbbdac0174af5f5dcd2cd91b1e4d928b695bfd1feda7bf4252a378b65f77ce8a1c217adf7d8ba556c20c5

Download Submit
memory/388-85-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/444-67-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/708-81-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/932-46-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1152-71-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1512-69-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1512-65-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1652-57-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1660-61-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2272-7-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2272-42-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2492-53-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3116-44-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3116-63-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3956-59-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4208-73-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4604-51-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4872-55-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4884-49-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4988-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4988-6-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/5444-75-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5524-89-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5548-83-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5616-87-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5860-77-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/6116-79-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download