617df5e5e7720cc89db1598ac6d033857fb3ca1453146c221c6b97f2ef600528

Analysis

max time kernel
102s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Badware.exe
Size

6.6MB
MD5

fb316f49281ab7de9fb838a9526800d6
SHA1

9e10615d4dd5f40ab3eb4a47adedfd14b44bef1a
SHA256

617df5e5e7720cc89db1598ac6d033857fb3ca1453146c221c6b97f2ef600528
SHA512

a6c20d76ad2778f585821500c431de6241b1b251f6a923cc0883578a695a3974000c4d76acdc158c8e371844b3f2a7233cf9e0e6e5d1bfa8c2700e29f9bc4fc9
SSDEEP

98304:+BbA9dwHlG3BEcledGY/KZZ+ioqjAtzFpLyK8tDmQz2RrG3Plkv1LTMS/LphYKUe:8gr3BZY/Nw+pLyfvV39OMS/L/

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/3524-134-0x0000000140000000-0x0000000140ED6000-memory.dmp	vmprotect
behavioral1/memory/3524-201-0x0000000140000000-0x0000000140ED6000-memory.dmp	vmprotect
behavioral1/memory/3524-202-0x0000000140000000-0x0000000140ED6000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3524	Badware.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	3524	WerFault.exe	79

Kills process with taskkill 31 IoCs

evasion

pid	Process
2100	taskkill.exe
1740	taskkill.exe
2196	taskkill.exe
1988	taskkill.exe
4668	taskkill.exe
4832	taskkill.exe
1928	taskkill.exe
956	taskkill.exe
220	taskkill.exe
1648	taskkill.exe
1044	taskkill.exe
4456	taskkill.exe
3472	taskkill.exe
3148	taskkill.exe
5100	taskkill.exe
2908	taskkill.exe
1712	taskkill.exe
404	taskkill.exe
3684	taskkill.exe
1808	taskkill.exe
4656	taskkill.exe
4420	taskkill.exe
612	taskkill.exe
1676	taskkill.exe
532	taskkill.exe
3020	taskkill.exe
4736	taskkill.exe
1932	taskkill.exe
2272	taskkill.exe
2432	taskkill.exe
932	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3524	Badware.exe
3524	Badware.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	5100	taskkill.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	4456	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	612	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	532	taskkill.exe
Token: SeDebugPrivilege	3472	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 5024	3524	Badware.exe	81
PID 3524 wrote to memory of 5024	3524	Badware.exe	81
PID 3524 wrote to memory of 632	3524	Badware.exe	82
PID 3524 wrote to memory of 632	3524	Badware.exe	82
PID 3524 wrote to memory of 1288	3524	Badware.exe	83
PID 3524 wrote to memory of 1288	3524	Badware.exe	83
PID 3524 wrote to memory of 1128	3524	Badware.exe	84
PID 3524 wrote to memory of 1128	3524	Badware.exe	84
PID 1128 wrote to memory of 4656	1128	cmd.exe	85
PID 1128 wrote to memory of 4656	1128	cmd.exe	85
PID 3524 wrote to memory of 2000	3524	Badware.exe	88
PID 3524 wrote to memory of 2000	3524	Badware.exe	88
PID 2000 wrote to memory of 1928	2000	cmd.exe	89
PID 2000 wrote to memory of 1928	2000	cmd.exe	89
PID 3524 wrote to memory of 3624	3524	Badware.exe	90
PID 3524 wrote to memory of 3624	3524	Badware.exe	90
PID 3624 wrote to memory of 220	3624	cmd.exe	91
PID 3624 wrote to memory of 220	3624	cmd.exe	91
PID 3524 wrote to memory of 3564	3524	Badware.exe	92
PID 3524 wrote to memory of 3564	3524	Badware.exe	92
PID 3564 wrote to memory of 404	3564	cmd.exe	93
PID 3564 wrote to memory of 404	3564	cmd.exe	93
PID 3524 wrote to memory of 4128	3524	Badware.exe	94
PID 3524 wrote to memory of 4128	3524	Badware.exe	94
PID 4128 wrote to memory of 1648	4128	cmd.exe	95
PID 4128 wrote to memory of 1648	4128	cmd.exe	95
PID 3524 wrote to memory of 4796	3524	Badware.exe	96
PID 3524 wrote to memory of 4796	3524	Badware.exe	96
PID 4796 wrote to memory of 1044	4796	cmd.exe	97
PID 4796 wrote to memory of 1044	4796	cmd.exe	97
PID 3524 wrote to memory of 3500	3524	Badware.exe	98
PID 3524 wrote to memory of 3500	3524	Badware.exe	98
PID 3500 wrote to memory of 4736	3500	cmd.exe	99
PID 3500 wrote to memory of 4736	3500	cmd.exe	99
PID 3524 wrote to memory of 4704	3524	Badware.exe	100
PID 3524 wrote to memory of 4704	3524	Badware.exe	100
PID 4704 wrote to memory of 4420	4704	cmd.exe	101
PID 4704 wrote to memory of 4420	4704	cmd.exe	101
PID 3524 wrote to memory of 508	3524	Badware.exe	102
PID 3524 wrote to memory of 508	3524	Badware.exe	102
PID 508 wrote to memory of 2100	508	cmd.exe	103
PID 508 wrote to memory of 2100	508	cmd.exe	103
PID 3524 wrote to memory of 1672	3524	Badware.exe	104
PID 3524 wrote to memory of 1672	3524	Badware.exe	104
PID 1672 wrote to memory of 3148	1672	cmd.exe	105
PID 1672 wrote to memory of 3148	1672	cmd.exe	105
PID 3524 wrote to memory of 2428	3524	Badware.exe	106
PID 3524 wrote to memory of 2428	3524	Badware.exe	106
PID 2428 wrote to memory of 1740	2428	cmd.exe	107
PID 2428 wrote to memory of 1740	2428	cmd.exe	107
PID 3524 wrote to memory of 1752	3524	Badware.exe	108
PID 3524 wrote to memory of 1752	3524	Badware.exe	108
PID 1752 wrote to memory of 5100	1752	cmd.exe	109
PID 1752 wrote to memory of 5100	1752	cmd.exe	109
PID 3524 wrote to memory of 2900	3524	Badware.exe	110
PID 3524 wrote to memory of 2900	3524	Badware.exe	110
PID 2900 wrote to memory of 4668	2900	cmd.exe	111
PID 2900 wrote to memory of 4668	2900	cmd.exe	111
PID 3524 wrote to memory of 2796	3524	Badware.exe	112
PID 3524 wrote to memory of 2796	3524	Badware.exe	112
PID 2796 wrote to memory of 3684	2796	cmd.exe	113
PID 2796 wrote to memory of 3684	2796	cmd.exe	113
PID 3524 wrote to memory of 1592	3524	Badware.exe	114
PID 3524 wrote to memory of 1592	3524	Badware.exe	114

C:\Users\Admin\AppData\Local\Temp\Badware.exe
"C:\Users\Admin\AppData\Local\Temp\Badware.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 06
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im epicgameslauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im steamservice.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steamservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im steam.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgtray.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgtray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping_BE.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im UnrealCEFSubProcess.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im UnrealCEFSubProcess.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im CEFProcess.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im CEFProcess.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EasyAntiCheat.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BEService.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BEServices.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BattleEye.exe >nul 2>&1
  2⤵
  PID:1592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im smartscreen.exe >nul 2>&1
  2⤵
  PID:4988
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im smartscreen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im dnf.exe >nul 2>&1
  2⤵
  PID:4416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im dnf.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im DNF.exe >nul 2>&1
  2⤵
  PID:4424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DNF.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im CrossProxy.exe >nul 2>&1
  2⤵
  PID:2268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im CrossProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BackgroundDownloader.exe >nul 2>&1
  2⤵
  PID:1720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BackgroundDownloader.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im TXPlatform.exe >nul 2>&1
  2⤵
  PID:3100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im TXPlatform.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OriginWebHelperService.exe >nul 2>&1
  2⤵
  PID:4004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginWebHelperService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Origin.exe >nul 2>&1
  2⤵
  PID:2260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Origin.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OriginClientService.exe >nul 2>&1
  2⤵
  PID:4024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginClientService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OriginER.exe >nul 2>&1
  2⤵
  PID:5076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginER.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OriginThinSetupInternal.exe >nul 2>&1
  2⤵
  PID:4356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginThinSetupInternal.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OriginLegacyCLI.exe >nul 2>&1
  2⤵
  PID:704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginLegacyCLI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Agent.exe >nul 2>&1
  2⤵
  PID:904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Agent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FiveM.exe >nul 2>&1
  2⤵
  PID:3184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FiveM.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FiveM_ROSLauncher.exe >nul 2>&1
  2⤵
  PID:444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FiveM_ROSLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FiveM_ROSService.exe >nul 2>&1
  2⤵
  PID:4032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FiveM_ROSService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3524 -s 432
  2⤵
  - Program crash
  PID:4792

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 3524 -ip 3524
1⤵
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-134-0x0000000140000000-0x0000000140ED6000-memory.dmp

Filesize
14.8MB

Download
memory/3524-202-0x0000000140000000-0x0000000140ED6000-memory.dmp

Filesize
14.8MB

Download
memory/3524-201-0x0000000140000000-0x0000000140ED6000-memory.dmp

Filesize
14.8MB

Download