Malware Analysis Report

2024-11-30 20:00

Sample ID 210119-88n6rsk2w6
Target CFDI__Manager__12365.exe
SHA256 82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
Tags
betabot backdoor botnet evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

Threat Level: Known bad

The file CFDI__Manager__12365.exe was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet evasion persistence trojan

BetaBot

Modifies firewall policy service

Sets file execution options in registry

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Adds Run key to start application

Checks whether UAC is enabled

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Suspicious use of FindShellTrayWindow

NTFS ADS

Modifies Internet Explorer Protected Mode Banner

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious behavior: RenamesItself

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer Protected Mode

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-01-19 19:41

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-01-19 19:41

Reported

2021-01-19 19:44

Platform

win10v20201028

Max time kernel

154s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\57ss733k.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\57ss733k.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\57ss733k.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 832 set thread context of 4000 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1632 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" C:\Windows\SysWOW64\explorer.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 832 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 832 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 832 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 832 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 832 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 4000 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 4000 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 4000 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 668 wrote to memory of 1632 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe
PID 668 wrote to memory of 1632 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe
PID 668 wrote to memory of 1632 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe
PID 668 wrote to memory of 3540 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe
PID 668 wrote to memory of 3540 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe
PID 668 wrote to memory of 3540 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe
PID 3540 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 212 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe
PID 668 wrote to memory of 212 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"

C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe

/suac

C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe

"C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.09\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'

C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe

"C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 windowsupdate.microsoft.com udp
N/A 52.185.71.28:80 windowsupdate.microsoft.com tcp
N/A 8.8.8.8:53 russk16.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 204.16.247.190:80 russk17.icu tcp
N/A 8.8.8.8:53 morningstarlincoln.co.uk udp
N/A 79.170.44.146:80 morningstarlincoln.co.uk tcp

Files

memory/4000-3-0x00000000004015C6-mapping.dmp

memory/4000-2-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4000-4-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4000-5-0x00000000020F0000-0x0000000002156000-memory.dmp

memory/4000-7-0x0000000002630000-0x0000000002631000-memory.dmp

memory/4000-6-0x00000000024B0000-0x00000000024BD000-memory.dmp

memory/4000-8-0x0000000002660000-0x000000000266C000-memory.dmp

memory/668-9-0x0000000000000000-mapping.dmp

memory/668-11-0x0000000000DA0000-0x00000000011E0000-memory.dmp

memory/668-12-0x0000000000BE0000-0x0000000000D14000-memory.dmp

memory/668-13-0x0000000003710000-0x000000000371D000-memory.dmp

memory/4000-10-0x0000000002650000-0x0000000002651000-memory.dmp

memory/668-17-0x0000000005530000-0x0000000005532000-memory.dmp

memory/1632-18-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe

MD5 5b7c3ff3556606c67a61527f81579eee
SHA1 75299ed8a21eebe1b1969e065e80f02ad21d4267
SHA256 82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA512 6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe

MD5 5b7c3ff3556606c67a61527f81579eee
SHA1 75299ed8a21eebe1b1969e065e80f02ad21d4267
SHA256 82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA512 6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe

MD5 6176d4702486a540afc4752ff32748e7
SHA1 1c59b8f1271a97a09967dacd8b8111d9c0e1b48a
SHA256 dc3f9a25a8df96d5a7f6e5fdb83159512c679462569f80ba8c639e08f7ded0eb
SHA512 bb88baed4e080b239c409d6bf5e187de68cbf6c298001b98be284f1772fcffc3c9b02ddf32a54cb70c2fcb08feadf20ca24ceacf2a0d84535c653e9eaab41d76

C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe

MD5 6176d4702486a540afc4752ff32748e7
SHA1 1c59b8f1271a97a09967dacd8b8111d9c0e1b48a
SHA256 dc3f9a25a8df96d5a7f6e5fdb83159512c679462569f80ba8c639e08f7ded0eb
SHA512 bb88baed4e080b239c409d6bf5e187de68cbf6c298001b98be284f1772fcffc3c9b02ddf32a54cb70c2fcb08feadf20ca24ceacf2a0d84535c653e9eaab41d76

memory/3540-21-0x0000000000000000-mapping.dmp

memory/3592-26-0x0000000000000000-mapping.dmp

memory/2828-27-0x0000000000000000-mapping.dmp

memory/2160-28-0x0000000000000000-mapping.dmp

memory/3916-29-0x0000000000000000-mapping.dmp

memory/2160-32-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmp

memory/3916-31-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmp

memory/3592-30-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmp

memory/2828-33-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmp

memory/3592-34-0x0000025998DD0000-0x0000025998DD1000-memory.dmp

memory/2160-38-0x00000276280C0000-0x00000276280C2000-memory.dmp

memory/3592-39-0x00000259B1260000-0x00000259B1262000-memory.dmp

memory/3592-40-0x00000259B1263000-0x00000259B1265000-memory.dmp

memory/2160-42-0x00000276426B0000-0x00000276426B1000-memory.dmp

memory/2160-41-0x00000276280C3000-0x00000276280C5000-memory.dmp

memory/2828-43-0x00000157C8FB0000-0x00000157C8FB2000-memory.dmp

memory/2828-44-0x00000157C8FB3000-0x00000157C8FB5000-memory.dmp

memory/3916-45-0x00000267F6310000-0x00000267F6312000-memory.dmp

memory/3916-46-0x00000267F6313000-0x00000267F6315000-memory.dmp

memory/2160-50-0x00000276280C6000-0x00000276280C8000-memory.dmp

memory/3592-51-0x00000259B1266000-0x00000259B1268000-memory.dmp

memory/3916-52-0x00000267F6316000-0x00000267F6318000-memory.dmp

memory/2828-53-0x00000157C8FB6000-0x00000157C8FB8000-memory.dmp

memory/212-54-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe

MD5 8ae38d41a537a39a726499d9195bb360
SHA1 d391b0d22763cc804451364bbe9fb102d6f32fac
SHA256 8a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA512 7c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3

C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe

MD5 8ae38d41a537a39a726499d9195bb360
SHA1 d391b0d22763cc804451364bbe9fb102d6f32fac
SHA256 8a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA512 7c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3

memory/212-57-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmp

memory/212-58-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/212-60-0x000000001B1C0000-0x000000001B1C2000-memory.dmp

memory/2160-61-0x00000276280C8000-0x00000276280C9000-memory.dmp

memory/2828-62-0x00000157C8FB8000-0x00000157C8FB9000-memory.dmp

memory/3916-63-0x00000267F6318000-0x00000267F6319000-memory.dmp

memory/3592-64-0x00000259B1268000-0x00000259B1269000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b39ad784a945662c6d042198e050e825
SHA1 899b3ca0e072377f0dff9f1e7c56c76582d56998
SHA256 f0d9c875fa0e7932acb477d8d0062fa8325f53259dcaaa79d8f77417fc31c44c
SHA512 a5f83ecf9184fb749e0e19dc67d09d72a8b042e0a1811387a30a7405cece6063df8544c0c66330fc0b1856b75f8c783868a956a057f152abc8501d1595f77a9c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 76711b32ad551401ac91da1a087c6e09
SHA1 ad0695820978056de9d67e23e9cab0880b57a667
SHA256 81a20f8c5ec86e516f174808420bc0f6f843702e6106a3ac8ea8917f1c35f11c
SHA512 54b0d5367cc54ffc22f7e9d013afeefe5e68ab82c4fb7b19d8941987d5d401ebcc94998c5232c4362a35f86ff42af8635fcc5423e9f6f7afa9e257cd448052ed

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 eb45d2fa89e11bd91a99444e420048ca
SHA1 1a7f8cae5055a36a0f6d5a7bcc4c046e21d60f32
SHA256 02d674d4d3cb757bcda6e0decb1d06ef726bd4457e5fafc7f52391c39a87bffc
SHA512 0381967cbab06ae7b395d31ec5ab03d5aec9999d1fbb36c9610c0d2c5b4cafdb831270563bdbd48a1e5c7effee1b9e6657163121ded058fd98ef557e5a7827bf

memory/212-69-0x000000001B1C3000-0x000000001B1C5000-memory.dmp

memory/212-71-0x000000001B1C7000-0x000000001B1C9000-memory.dmp

memory/212-70-0x000000001B1C5000-0x000000001B1C7000-memory.dmp

memory/212-72-0x000000001B1C9000-0x000000001B1CF000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2021-01-19 19:41

Reported

2021-01-19 19:44

Platform

win7v20201028

Max time kernel

147s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\75oy151k7.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\75oy151k7.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\75oy151k7.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1904 set thread context of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1196 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Windows\SysWOW64\explorer.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1904 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1904 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1904 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1904 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1904 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 1904 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 904 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe C:\Windows\SysWOW64\explorer.exe
PID 1596 wrote to memory of 1228 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\Dwm.exe
PID 1596 wrote to memory of 1228 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\Dwm.exe
PID 1596 wrote to memory of 1228 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\Dwm.exe
PID 1596 wrote to memory of 1228 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\Dwm.exe
PID 1596 wrote to memory of 1228 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\Dwm.exe
PID 1596 wrote to memory of 1228 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\Dwm.exe
PID 1596 wrote to memory of 1268 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE
PID 1596 wrote to memory of 1268 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE
PID 1596 wrote to memory of 1268 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE
PID 1596 wrote to memory of 1268 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE
PID 1596 wrote to memory of 1268 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE
PID 1596 wrote to memory of 1268 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 1196 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 272 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe
PID 1596 wrote to memory of 1376 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"

C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe

/suac

C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe

"C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe"

C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe

"C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 google.com udp
N/A 216.58.214.14:80 google.com tcp
N/A 8.8.8.8:53 russk16.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 204.16.247.190:80 russk17.icu tcp
N/A 8.8.8.8:53 morningstarlincoln.co.uk udp
N/A 79.170.44.146:80 morningstarlincoln.co.uk tcp

Files

memory/904-2-0x0000000000400000-0x0000000000435000-memory.dmp

memory/904-3-0x00000000004015C6-mapping.dmp

memory/904-4-0x00000000766F1000-0x00000000766F3000-memory.dmp

memory/904-6-0x0000000001C40000-0x0000000001CA6000-memory.dmp

memory/904-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/904-5-0x0000000000400000-0x0000000000435000-memory.dmp

memory/904-9-0x0000000000500000-0x0000000000501000-memory.dmp

memory/904-8-0x00000000001D0000-0x00000000001DD000-memory.dmp

memory/904-10-0x0000000001DD0000-0x0000000001DDC000-memory.dmp

memory/1596-11-0x0000000000000000-mapping.dmp

memory/1596-13-0x0000000074D71000-0x0000000074D73000-memory.dmp

memory/1596-15-0x0000000000200000-0x0000000000334000-memory.dmp

memory/1596-14-0x0000000077740000-0x00000000778C1000-memory.dmp

memory/1596-19-0x00000000009B0000-0x00000000009BC000-memory.dmp

memory/904-20-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

memory/1596-22-0x0000000002090000-0x0000000002092000-memory.dmp

memory/340-23-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe

MD5 5b7c3ff3556606c67a61527f81579eee
SHA1 75299ed8a21eebe1b1969e065e80f02ad21d4267
SHA256 82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA512 6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

memory/1196-25-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe

MD5 5b7c3ff3556606c67a61527f81579eee
SHA1 75299ed8a21eebe1b1969e065e80f02ad21d4267
SHA256 82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA512 6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

C:\Users\Admin\AppData\Local\Temp\75oy151k7_1.exe

MD5 5b7c3ff3556606c67a61527f81579eee
SHA1 75299ed8a21eebe1b1969e065e80f02ad21d4267
SHA256 82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA512 6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe

MD5 6176d4702486a540afc4752ff32748e7
SHA1 1c59b8f1271a97a09967dacd8b8111d9c0e1b48a
SHA256 dc3f9a25a8df96d5a7f6e5fdb83159512c679462569f80ba8c639e08f7ded0eb
SHA512 bb88baed4e080b239c409d6bf5e187de68cbf6c298001b98be284f1772fcffc3c9b02ddf32a54cb70c2fcb08feadf20ca24ceacf2a0d84535c653e9eaab41d76

C:\Users\Admin\AppData\Local\Temp\cc9mwi9s.exe

MD5 6176d4702486a540afc4752ff32748e7
SHA1 1c59b8f1271a97a09967dacd8b8111d9c0e1b48a
SHA256 dc3f9a25a8df96d5a7f6e5fdb83159512c679462569f80ba8c639e08f7ded0eb
SHA512 bb88baed4e080b239c409d6bf5e187de68cbf6c298001b98be284f1772fcffc3c9b02ddf32a54cb70c2fcb08feadf20ca24ceacf2a0d84535c653e9eaab41d76

memory/272-29-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe

MD5 8ae38d41a537a39a726499d9195bb360
SHA1 d391b0d22763cc804451364bbe9fb102d6f32fac
SHA256 8a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA512 7c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3

C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe

MD5 8ae38d41a537a39a726499d9195bb360
SHA1 d391b0d22763cc804451364bbe9fb102d6f32fac
SHA256 8a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA512 7c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3

C:\Users\Admin\AppData\Local\Temp\g5e5akco9usg.exe

MD5 8ae38d41a537a39a726499d9195bb360
SHA1 d391b0d22763cc804451364bbe9fb102d6f32fac
SHA256 8a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA512 7c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3

memory/1376-34-0x0000000000000000-mapping.dmp

memory/1376-37-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

memory/1376-38-0x0000000000B10000-0x0000000000B11000-memory.dmp

memory/1376-40-0x000000001B5B0000-0x000000001B5B2000-memory.dmp

memory/1376-41-0x000000001B5B2000-0x000000001B5B3000-memory.dmp

memory/1376-42-0x000000001B5B7000-0x000000001B5D6000-memory.dmp

memory/1268-43-0x00000000025A0000-0x00000000025A6000-memory.dmp