Overview
overview
10Static
static
10TrashMalwa...in.exe
windows10-2004-x64
8TrashMalwa...er.exe
windows10-2004-x64
8TrashMalwa...nk.exe
windows10-2004-x64
8TrashMalwa...oN.bat
windows10-2004-x64
8TrashMalwa...zz.exe
windows10-2004-x64
6TrashMalwa...de.exe
windows10-2004-x64
8TrashMalwa...20.exe
windows10-2004-x64
7TrashMalwa...ll.exe
windows10-2004-x64
8TrashMalwa...le.exe
windows10-2004-x64
8TrashMalwa...oe.bat
windows10-2004-x64
TrashMalwa....0.exe
windows10-2004-x64
7TrashMalwa....0.exe
windows10-2004-x64
8TrashMalwa....0.exe
windows10-2004-x64
8TrashMalwa...ic.exe
windows10-2004-x64
6TrashMalwa...OD.exe
windows10-2004-x64
10TrashMalwa...um.exe
windows10-2004-x64
6TrashMalwa...er.exe
windows10-2004-x64
8TrashMalwa...MZ.exe
windows10-2004-x64
1TrashMalwa...ch.exe
windows10-2004-x64
8TrashMalwa....5.exe
windows10-2004-x64
8TrashMalwa...ol.exe
windows10-2004-x64
8TrashMalwa...hm.exe
windows10-2004-x64
10TrashMalwa...10.exe
windows10-2004-x64
7TrashMalwa...V6.exe
windows10-2004-x64
7TrashMalwa.../x.exe
windows10-2004-x64
7Analysis
-
max time kernel
301s -
max time network
330s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 14:13
Behavioral task
behavioral1
Sample
TrashMalwares-main/AcidRain.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
TrashMalwares-main/Antivirus_Installer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
TrashMalwares-main/Dro trojan. Virus prank.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
TrashMalwares-main/FaZoN.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
TrashMalwares-main/Fizz.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral6
Sample
TrashMalwares-main/Ginxide.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
TrashMalwares-main/Install Windows20.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
TrashMalwares-main/MS-RickRoll.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
TrashMalwares-main/MercuryXhoffle.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral10
Sample
TrashMalwares-main/NetPakoe.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
TrashMalwares-main/NetPakoe3.0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral12
Sample
TrashMalwares-main/NoEscape8.0.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
TrashMalwares-main/PC shaking v4.0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral14
Sample
TrashMalwares-main/Phsyletric.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
TrashMalwares-main/RealBSOD.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
TrashMalwares-main/Sankylium.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
TrashMalwares-main/SuperWacker.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral18
Sample
TrashMalwares-main/TEMZ.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
TrashMalwares-main/ach.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral20
Sample
TrashMalwares-main/even0.5.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
TrashMalwares-main/lol.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral22
Sample
TrashMalwares-main/mhm.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
TrashMalwares-main/winnit6.6.6 V10.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral24
Sample
TrashMalwares-main/winnit6.6.6_V6.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
TrashMalwares-main/x.exe
Resource
win10v2004-20220812-en
General
-
Target
TrashMalwares-main/lol.exe
-
Size
37KB
-
MD5
9b83bffc3fdc0219471d937e2343d5d8
-
SHA1
9e45b98a6eb05399ca5e20504e965844f9d1a406
-
SHA256
982e75c4603d2e02864bdc6847020f5ee29c7265639e8a040fe37ae241f6433e
-
SHA512
781b6cbca6cde428094189e12443c8723e543ac3df3a42b69e9eba83c890602dd31878eb33dbfb46a593d9746c9e14b024e81341688439851dff269446c56322
-
SSDEEP
384:NwSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXs:uS7TZ38fvCv3E1cQrM+rMRa8Nu29t
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
lol.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a592a96ea7c45f9ee4a9c42a1e0f9d.exe lol.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a592a96ea7c45f9ee4a9c42a1e0f9d.exe lol.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
lol.exepid process 4952 lol.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
lol.exedescription pid process Token: SeDebugPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe Token: SeIncBasePriorityPrivilege 4952 lol.exe Token: 33 4952 lol.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
lol.exedescription pid process target process PID 4952 wrote to memory of 1060 4952 lol.exe netsh.exe PID 4952 wrote to memory of 1060 4952 lol.exe netsh.exe PID 4952 wrote to memory of 1060 4952 lol.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\lol.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\lol.exe"1⤵
- Drops startup file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\lol.exe" "lol.exe" ENABLE2⤵
- Modifies Windows Firewall