darkcomet | 42d412d8f6d6725326275f413cbe880c3489f4322d278a34830c42a5c47389e2

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Facebook Account Hacker.exe
Size

1002KB
MD5

810ee30f3831206f115a9de523d553ea
SHA1

cce8aa42fff602345db5baa6b20bf663481ccb07
SHA256

16af77f601bb55b12c0d4f4ec36c600fa651bb3c085b6342bd93437d287024d1
SHA512

ec00695ba3aacb276b7a4f12f116e171f978363f5fc4f9c7f6a00ecfa8d4f61fa198f747ba0d107155b7992366655af78c7a00d034845d03a87b477ef7c2f305
SSDEEP

24576:M3nbWmJVJFwSddIXvfhqbiaxvRxq9ULjpc:yamdZdcBYtPpc

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeFacebook Account Hacker.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	Facebook Account Hacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Sets file to hidden 1 TTPs 46 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
468	attrib.exe
2848	attrib.exe
1972	attrib.exe
2636	attrib.exe
1296	attrib.exe
2228	attrib.exe
700	attrib.exe
884	attrib.exe
548	attrib.exe
2596	attrib.exe
2476	attrib.exe
1688	attrib.exe
1660	attrib.exe
1448	attrib.exe
996	attrib.exe
2768	attrib.exe
2024	attrib.exe
1596	attrib.exe
1708	attrib.exe
2616	attrib.exe
1180	attrib.exe
2580	attrib.exe
2996	attrib.exe
2124	attrib.exe
2360	attrib.exe
2812	attrib.exe
1088	attrib.exe
1900	attrib.exe
2572	attrib.exe
2188	attrib.exe
1052	attrib.exe
2228	attrib.exe
1048	attrib.exe
2624	attrib.exe
612	attrib.exe
2844	attrib.exe
2036	attrib.exe
2240	attrib.exe
652	attrib.exe
1100	attrib.exe
1848	attrib.exe
2356	attrib.exe
1404	attrib.exe
2812	attrib.exe
1352	attrib.exe
1932	attrib.exe

Executes dropped EXE 46 IoCs

Processes:

FACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exeFACEBOOK HACK BY ANONYMOUS.EXEmsdcsc.exe

pid	process
2700	FACEBOOK HACK BY ANONYMOUS.EXE
2624	msdcsc.exe
2788	FACEBOOK HACK BY ANONYMOUS.EXE
352	msdcsc.exe
2132	FACEBOOK HACK BY ANONYMOUS.EXE
1256	msdcsc.exe
2836	FACEBOOK HACK BY ANONYMOUS.EXE
2996	msdcsc.exe
3052	FACEBOOK HACK BY ANONYMOUS.EXE
1852	msdcsc.exe
2072	FACEBOOK HACK BY ANONYMOUS.EXE
2164	msdcsc.exe
2632	FACEBOOK HACK BY ANONYMOUS.EXE
2488	msdcsc.exe
2344	FACEBOOK HACK BY ANONYMOUS.EXE
1656	msdcsc.exe
348	FACEBOOK HACK BY ANONYMOUS.EXE
2076	msdcsc.exe
832	FACEBOOK HACK BY ANONYMOUS.EXE
748	msdcsc.exe
2320	FACEBOOK HACK BY ANONYMOUS.EXE
2156	msdcsc.exe
628	FACEBOOK HACK BY ANONYMOUS.EXE
2740	msdcsc.exe
1784	FACEBOOK HACK BY ANONYMOUS.EXE
2100	msdcsc.exe
1964	FACEBOOK HACK BY ANONYMOUS.EXE
2248	msdcsc.exe
1100	FACEBOOK HACK BY ANONYMOUS.EXE
2304	msdcsc.exe
1344	FACEBOOK HACK BY ANONYMOUS.EXE
1708	msdcsc.exe
1664	FACEBOOK HACK BY ANONYMOUS.EXE
2572	msdcsc.exe
2580	FACEBOOK HACK BY ANONYMOUS.EXE
2668	msdcsc.exe
1808	FACEBOOK HACK BY ANONYMOUS.EXE
2284	msdcsc.exe
1788	FACEBOOK HACK BY ANONYMOUS.EXE
1608	msdcsc.exe
2348	FACEBOOK HACK BY ANONYMOUS.EXE
876	msdcsc.exe
1916	FACEBOOK HACK BY ANONYMOUS.EXE
2164	msdcsc.exe
564	FACEBOOK HACK BY ANONYMOUS.EXE
1148	msdcsc.exe

Loads dropped DLL 64 IoCs

Processes:

Facebook Account Hacker.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
1492	Facebook Account Hacker.exe
1492	Facebook Account Hacker.exe
1492	Facebook Account Hacker.exe
2624	msdcsc.exe
2624	msdcsc.exe
2624	msdcsc.exe
352	msdcsc.exe
352	msdcsc.exe
352	msdcsc.exe
1256	msdcsc.exe
1256	msdcsc.exe
1256	msdcsc.exe
2996	msdcsc.exe
2996	msdcsc.exe
2996	msdcsc.exe
1852	msdcsc.exe
1852	msdcsc.exe
1852	msdcsc.exe
2164	msdcsc.exe
2164	msdcsc.exe
2164	msdcsc.exe
2488	msdcsc.exe
2488	msdcsc.exe
2488	msdcsc.exe
1656	msdcsc.exe
1656	msdcsc.exe
1656	msdcsc.exe
2076	msdcsc.exe
2076	msdcsc.exe
2076	msdcsc.exe
748	msdcsc.exe
748	msdcsc.exe
748	msdcsc.exe
2156	msdcsc.exe
2156	msdcsc.exe
2156	msdcsc.exe
2740	msdcsc.exe
2740	msdcsc.exe
2740	msdcsc.exe
2100	msdcsc.exe
2100	msdcsc.exe
2100	msdcsc.exe
2248	msdcsc.exe
2248	msdcsc.exe
2248	msdcsc.exe
2304	msdcsc.exe
2304	msdcsc.exe
2304	msdcsc.exe
1708	msdcsc.exe
1708	msdcsc.exe
1708	msdcsc.exe
2572	msdcsc.exe
2572	msdcsc.exe
2572	msdcsc.exe
2668	msdcsc.exe
2668	msdcsc.exe
2668	msdcsc.exe
2284	msdcsc.exe
2284	msdcsc.exe
2284	msdcsc.exe
1608	msdcsc.exe
1608	msdcsc.exe
1608	msdcsc.exe
876	msdcsc.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeFacebook Account Hacker.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	Facebook Account Hacker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 64 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exeFacebook Account Hacker.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	Facebook Account Hacker.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	Facebook Account Hacker.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Facebook Account Hacker.exemsdcsc.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1492	Facebook Account Hacker.exe
Token: SeSecurityPrivilege	1492	Facebook Account Hacker.exe
Token: SeTakeOwnershipPrivilege	1492	Facebook Account Hacker.exe
Token: SeLoadDriverPrivilege	1492	Facebook Account Hacker.exe
Token: SeSystemProfilePrivilege	1492	Facebook Account Hacker.exe
Token: SeSystemtimePrivilege	1492	Facebook Account Hacker.exe
Token: SeProfSingleProcessPrivilege	1492	Facebook Account Hacker.exe
Token: SeIncBasePriorityPrivilege	1492	Facebook Account Hacker.exe
Token: SeCreatePagefilePrivilege	1492	Facebook Account Hacker.exe
Token: SeBackupPrivilege	1492	Facebook Account Hacker.exe
Token: SeRestorePrivilege	1492	Facebook Account Hacker.exe
Token: SeShutdownPrivilege	1492	Facebook Account Hacker.exe
Token: SeDebugPrivilege	1492	Facebook Account Hacker.exe
Token: SeSystemEnvironmentPrivilege	1492	Facebook Account Hacker.exe
Token: SeChangeNotifyPrivilege	1492	Facebook Account Hacker.exe
Token: SeRemoteShutdownPrivilege	1492	Facebook Account Hacker.exe
Token: SeUndockPrivilege	1492	Facebook Account Hacker.exe
Token: SeManageVolumePrivilege	1492	Facebook Account Hacker.exe
Token: SeImpersonatePrivilege	1492	Facebook Account Hacker.exe
Token: SeCreateGlobalPrivilege	1492	Facebook Account Hacker.exe
Token: 33	1492	Facebook Account Hacker.exe
Token: 34	1492	Facebook Account Hacker.exe
Token: 35	1492	Facebook Account Hacker.exe
Token: SeIncreaseQuotaPrivilege	2624	msdcsc.exe
Token: SeSecurityPrivilege	2624	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2624	msdcsc.exe
Token: SeLoadDriverPrivilege	2624	msdcsc.exe
Token: SeSystemProfilePrivilege	2624	msdcsc.exe
Token: SeSystemtimePrivilege	2624	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2624	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2624	msdcsc.exe
Token: SeCreatePagefilePrivilege	2624	msdcsc.exe
Token: SeBackupPrivilege	2624	msdcsc.exe
Token: SeRestorePrivilege	2624	msdcsc.exe
Token: SeShutdownPrivilege	2624	msdcsc.exe
Token: SeDebugPrivilege	2624	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2624	msdcsc.exe
Token: SeChangeNotifyPrivilege	2624	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2624	msdcsc.exe
Token: SeUndockPrivilege	2624	msdcsc.exe
Token: SeManageVolumePrivilege	2624	msdcsc.exe
Token: SeImpersonatePrivilege	2624	msdcsc.exe
Token: SeCreateGlobalPrivilege	2624	msdcsc.exe
Token: 33	2624	msdcsc.exe
Token: 34	2624	msdcsc.exe
Token: 35	2624	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	352	msdcsc.exe
Token: SeSecurityPrivilege	352	msdcsc.exe
Token: SeTakeOwnershipPrivilege	352	msdcsc.exe
Token: SeLoadDriverPrivilege	352	msdcsc.exe
Token: SeSystemProfilePrivilege	352	msdcsc.exe
Token: SeSystemtimePrivilege	352	msdcsc.exe
Token: SeProfSingleProcessPrivilege	352	msdcsc.exe
Token: SeIncBasePriorityPrivilege	352	msdcsc.exe
Token: SeCreatePagefilePrivilege	352	msdcsc.exe
Token: SeBackupPrivilege	352	msdcsc.exe
Token: SeRestorePrivilege	352	msdcsc.exe
Token: SeShutdownPrivilege	352	msdcsc.exe
Token: SeDebugPrivilege	352	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	352	msdcsc.exe
Token: SeChangeNotifyPrivilege	352	msdcsc.exe
Token: SeRemoteShutdownPrivilege	352	msdcsc.exe
Token: SeUndockPrivilege	352	msdcsc.exe
Token: SeManageVolumePrivilege	352	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Facebook Account Hacker.execmd.execmd.exemsdcsc.execmd.execmd.exemsdcsc.execmd.exe

description	pid	process	target process
PID 1492 wrote to memory of 2052	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2052	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2052	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2052	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2676	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2676	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2676	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2676	1492	Facebook Account Hacker.exe	cmd.exe
PID 1492 wrote to memory of 2700	1492	Facebook Account Hacker.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 1492 wrote to memory of 2700	1492	Facebook Account Hacker.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 1492 wrote to memory of 2700	1492	Facebook Account Hacker.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 1492 wrote to memory of 2700	1492	Facebook Account Hacker.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 2052 wrote to memory of 2360	2052	cmd.exe	attrib.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	attrib.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	attrib.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	attrib.exe
PID 2676 wrote to memory of 2812	2676	cmd.exe	attrib.exe
PID 2676 wrote to memory of 2812	2676	cmd.exe	attrib.exe
PID 2676 wrote to memory of 2812	2676	cmd.exe	attrib.exe
PID 2676 wrote to memory of 2812	2676	cmd.exe	attrib.exe
PID 1492 wrote to memory of 2624	1492	Facebook Account Hacker.exe	msdcsc.exe
PID 1492 wrote to memory of 2624	1492	Facebook Account Hacker.exe	msdcsc.exe
PID 1492 wrote to memory of 2624	1492	Facebook Account Hacker.exe	msdcsc.exe
PID 1492 wrote to memory of 2624	1492	Facebook Account Hacker.exe	msdcsc.exe
PID 2624 wrote to memory of 2344	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2344	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2344	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2344	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2768	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2768	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2768	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2768	2624	msdcsc.exe	cmd.exe
PID 2624 wrote to memory of 2788	2624	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 2624 wrote to memory of 2788	2624	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 2624 wrote to memory of 2788	2624	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 2624 wrote to memory of 2788	2624	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 2344 wrote to memory of 1404	2344	cmd.exe	attrib.exe
PID 2344 wrote to memory of 1404	2344	cmd.exe	attrib.exe
PID 2344 wrote to memory of 1404	2344	cmd.exe	attrib.exe
PID 2344 wrote to memory of 1404	2344	cmd.exe	attrib.exe
PID 2768 wrote to memory of 2240	2768	cmd.exe	attrib.exe
PID 2768 wrote to memory of 2240	2768	cmd.exe	attrib.exe
PID 2768 wrote to memory of 2240	2768	cmd.exe	attrib.exe
PID 2768 wrote to memory of 2240	2768	cmd.exe	attrib.exe
PID 2624 wrote to memory of 352	2624	msdcsc.exe	msdcsc.exe
PID 2624 wrote to memory of 352	2624	msdcsc.exe	msdcsc.exe
PID 2624 wrote to memory of 352	2624	msdcsc.exe	msdcsc.exe
PID 2624 wrote to memory of 352	2624	msdcsc.exe	msdcsc.exe
PID 352 wrote to memory of 1032	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1032	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1032	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1032	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1808	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1808	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1808	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 1808	352	msdcsc.exe	cmd.exe
PID 352 wrote to memory of 2132	352	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 352 wrote to memory of 2132	352	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 352 wrote to memory of 2132	352	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 352 wrote to memory of 2132	352	msdcsc.exe	FACEBOOK HACK BY ANONYMOUS.EXE
PID 1032 wrote to memory of 1972	1032	cmd.exe	attrib.exe
PID 1032 wrote to memory of 1972	1032	cmd.exe	attrib.exe
PID 1032 wrote to memory of 1972	1032	cmd.exe	attrib.exe
PID 1032 wrote to memory of 1972	1032	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 46 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
2228	attrib.exe
2360	attrib.exe
884	attrib.exe
700	attrib.exe
2188	attrib.exe
2124	attrib.exe
996	attrib.exe
2356	attrib.exe
1708	attrib.exe
2572	attrib.exe
1180	attrib.exe
2996	attrib.exe
2812	attrib.exe
1404	attrib.exe
2616	attrib.exe
468	attrib.exe
2848	attrib.exe
1848	attrib.exe
2476	attrib.exe
1900	attrib.exe
612	attrib.exe
2024	attrib.exe
2228	attrib.exe
1596	attrib.exe
1296	attrib.exe
2844	attrib.exe
1448	attrib.exe
2240	attrib.exe
652	attrib.exe
1048	attrib.exe
2624	attrib.exe
1052	attrib.exe
1660	attrib.exe
1972	attrib.exe
1100	attrib.exe
2812	attrib.exe
2580	attrib.exe
1352	attrib.exe
548	attrib.exe
2596	attrib.exe
1932	attrib.exe
1088	attrib.exe
2636	attrib.exe
1688	attrib.exe
2036	attrib.exe
2768	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Facebook Account Hacker.exe
"C:\Users\Admin\AppData\Local\Temp\Facebook Account Hacker.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2812

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
2⤵
- Executes dropped EXE
PID:2700

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
4⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2240

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
3⤵
- Executes dropped EXE
PID:2788

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1972

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
4⤵
PID:1808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1088

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
4⤵
- Executes dropped EXE
PID:2132

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
PID:1684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:652

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
PID:2840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1100

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
5⤵
- Executes dropped EXE
PID:2836

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
6⤵
PID:408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
7⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
6⤵
PID:3020

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
7⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1848

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
6⤵
- Executes dropped EXE
PID:3052

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
7⤵
PID:2356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
7⤵
PID:852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1048

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
7⤵
- Executes dropped EXE
PID:2072

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
8⤵
PID:2900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
9⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
8⤵
PID:2668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2812

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
8⤵
- Executes dropped EXE
PID:2632

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
9⤵
PID:2780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
10⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
9⤵
PID:2100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
10⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2624

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
9⤵
- Executes dropped EXE
PID:2344

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1656

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
10⤵
PID:1448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
11⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
10⤵
PID:1780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
11⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1596

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
10⤵
- Executes dropped EXE
PID:348

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
11⤵
PID:320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
12⤵
- Sets file to hidden
- Views/modifies file attributes
PID:612

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
11⤵
PID:1548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1900

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
11⤵
- Executes dropped EXE
PID:832

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
11⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
12⤵
PID:1372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2844

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
12⤵
PID:1632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1708

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
12⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
13⤵
PID:2120

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
14⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2572

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
13⤵
PID:2260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2616

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
13⤵
- Executes dropped EXE
PID:628

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
14⤵
PID:2164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
15⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
14⤵
PID:304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
15⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1180

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
14⤵
- Executes dropped EXE
PID:1784

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
14⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
15⤵
PID:2532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
16⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
15⤵
PID:1808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1448

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
15⤵
- Executes dropped EXE
PID:1964

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2248

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
16⤵
PID:2528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
17⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
16⤵
PID:1684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
17⤵
- Sets file to hidden
- Views/modifies file attributes
PID:700

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
16⤵
- Executes dropped EXE
PID:1100

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
16⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
17⤵
PID:1716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
17⤵
PID:3036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2036

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
17⤵
- Executes dropped EXE
PID:1344

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
17⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1708

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
18⤵
PID:3024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
19⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
18⤵
PID:2380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
19⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1352

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
18⤵
- Executes dropped EXE
PID:1664

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2572

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
19⤵
PID:2688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
20⤵
- Sets file to hidden
- Views/modifies file attributes
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
19⤵
PID:2556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2124

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
19⤵
- Executes dropped EXE
PID:2580

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
19⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
20⤵
PID:1904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
21⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2596

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
20⤵
PID:1448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
21⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1932

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
20⤵
- Executes dropped EXE
PID:1808

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
20⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
21⤵
PID:2528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
22⤵
- Sets file to hidden
- Views/modifies file attributes
PID:996

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
21⤵
PID:1656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:468

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
21⤵
- Executes dropped EXE
PID:1788

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
22⤵
PID:784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
23⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
22⤵
PID:2944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
23⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2848

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
22⤵
- Executes dropped EXE
PID:2348

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:876

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
23⤵
PID:1708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
24⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
23⤵
PID:2972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
24⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2768

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
23⤵
- Executes dropped EXE
PID:1916

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
23⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
24⤵
PID:2572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
25⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
24⤵
PID:1936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
25⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1052

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
"C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE"
24⤵
- Executes dropped EXE
PID:564

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1148

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FACEBOOK HACK BY ANONYMOUS.EXE
Filesize
180KB

MD5
7d8c2af7a794c92ab5f99c39b3ea412b

SHA1
94fde30b423cadcf2459410e10227545f370bfc1

SHA256
cc166ff5aa7a0a1aaf0463139d1a8bd069707a1ec43f9680155219a4786ce333

SHA512
89d96f9edaff9ce5b950398ebf467096cbfd9a704d640cb3b1d97aedcf1786790fde928d5e86a514167be5135e06c29bdd0a2697da9de6040410d13e0da1223a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
78B

MD5
9f9fce0aaa63f0ad4003dc6f5cde1f59

SHA1
5d9df8d4cffc9575c297008b36a91b0160182f7d

SHA256
5dd4c0d6fcd6b71f214641d6e7f0b9cd81c87fdf9dad47ee499a277699e7be72

SHA512
8569281415a0c5c0ad1a7ceaf2261c6846249f3c8f76d9e2d498ab174fc6a9f7236d7437b76993495f1b398cfff8729775e88021450b4d3bacd4ca49ff9c241e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
50B

MD5
b774ae3fb1da087e1f83b4f7b2060e5a

SHA1
97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

SHA256
adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

SHA512
f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
54B

MD5
b960305e23cbfd65106f326e54e2edfd

SHA1
522c5e95a4306797b3e71bbe62158087f779ee7a

SHA256
c31911cf00619f811195612355d7c762cd7e65d7d06756f62815b029cda65855

SHA512
294181df282b6901de3e2743a6986637303f7bc63555ad171c07f6457d2895907aeae800eb7f948ac6380ba87e76423eb150792d05754aa6152c9d9921edc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
43B

MD5
54552c311a8c2081eefdad310b19b5db

SHA1
718edabb22a5b5481815682eb1b3cd17c316c1dc

SHA256
233765af9f5b64cdcae82b709e94f3d26d9486c90e3074a79ebeb915e386bfea

SHA512
dc004dfaacba0417a6e631099c46ca99a832000286baabfa035a176e5b99fdd78f61c97a37d7d1b8e29711b657bc5df4bc601a28c431c38b2395347858cd4f02

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
1002KB

MD5
810ee30f3831206f115a9de523d553ea

SHA1
cce8aa42fff602345db5baa6b20bf663481ccb07

SHA256
16af77f601bb55b12c0d4f4ec36c600fa651bb3c085b6342bd93437d287024d1

SHA512
ec00695ba3aacb276b7a4f12f116e171f978363f5fc4f9c7f6a00ecfa8d4f61fa198f747ba0d107155b7992366655af78c7a00d034845d03a87b477ef7c2f305

Download Submit
memory/352-87-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/748-274-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/876-478-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1256-112-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1492-38-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1492-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1608-458-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1656-234-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1708-382-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1852-161-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2076-256-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2100-328-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2156-292-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2164-186-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2164-496-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2248-346-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2284-438-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2304-364-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2488-210-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2572-400-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2624-63-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2668-420-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2700-29-0x00000000001E0000-0x0000000000214000-memory.dmp

Filesize
208KB

Download
memory/2740-310-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2996-137-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads