cde3720e9c1d758e606495f4eb216e165e0e2bbe80c9018f32287ae31f553693

Resubmissions

28-11-2022 09:53

221128-lwp4eaea33 10

17-11-2022 04:28

221117-e328zsdf69 10

07-11-2022 10:35

221107-mm272secgj 10

Analysis

max time kernel
23s
max time network
44s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update.exe
Size

60.2MB
MD5

b77955061c0f46de8059c20128ebb156
SHA1

bd9ba700caec09387bfcf97bd9cc0a2e846836ca
SHA256

ca94c8bbbb10febb8187f8c709affaa91911f646cf0ac99e857bf45b3a709091
SHA512

83f07b66be1138e5f3f1c1f2504d3222bcc1bb1c1626a98e2346408cde7c771a64a998fa38c23ac66097f0b610f70c6309ea914e0c9c95ecff588a385aeb69aa
SSDEEP

1572864:DdjkMwgaV4gRNzu1zCcFA4o/UDDvX94UKfytNxZhDa:FJGuMzuHnXDKfeN5Da

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	update.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	update.exe

Blocks application from running via registry modification 27 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "Cureit.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe"	update.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	update.exe

Modifies Windows Firewall 1 TTPs 7 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1952	netsh.exe
780	netsh.exe
524	netsh.exe
1276	netsh.exe
1384	netsh.exe
744	netsh.exe
1708	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	update.exe

Themida packer 31 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1380-55-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-57-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-58-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-59-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-60-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-61-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-62-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-63-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-64-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/memory/1380-65-0x000000013F2A0000-0x0000000143563000-memory.dmp	themida
behavioral1/files/0x000c00000001231c-95.dat	themida
behavioral1/files/0x000c00000001231c-97.dat	themida
behavioral1/files/0x000700000001267b-101.dat	themida
behavioral1/files/0x000700000001267b-99.dat	themida
behavioral1/files/0x000c00000001231c-103.dat	themida
behavioral1/files/0x000700000001267b-104.dat	themida
behavioral1/files/0x000700000001267b-109.dat	themida
behavioral1/files/0x000700000001267b-110.dat	themida
behavioral1/files/0x000c00000001231c-108.dat	themida
behavioral1/files/0x000c00000001231c-107.dat	themida
behavioral1/memory/1476-111-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-112-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-113-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-114-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-115-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-116-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-118-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/1476-120-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida
behavioral1/memory/880-117-0x000000013F1B0000-0x00000001424D2000-memory.dmp	themida
behavioral1/memory/880-121-0x000000013F1B0000-0x00000001424D2000-memory.dmp	themida
behavioral1/memory/1476-125-0x000000013FF40000-0x0000000140B08000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Plex Media Server = "C:\\ProgramData\\Windows Tasks Service\\winserv.exe"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhost.exe"	update.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	update.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1380-58-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-59-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-60-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-61-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-62-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-63-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-64-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1380-65-0x000000013F2A0000-0x0000000143563000-memory.dmp	autoit_exe
behavioral1/memory/1476-112-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-113-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-114-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-115-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-116-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-118-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/1476-120-0x000000013FF40000-0x0000000140B08000-memory.dmp	autoit_exe
behavioral1/memory/880-121-0x000000013F1B0000-0x00000001424D2000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1380	update.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
668	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1380	update.exe
1380	update.exe
1380	update.exe
1380	update.exe
1380	update.exe
1380	update.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1780	1380	update.exe	28
PID 1380 wrote to memory of 1780	1380	update.exe	28
PID 1380 wrote to memory of 1780	1380	update.exe	28
PID 1780 wrote to memory of 668	1780	cmd.exe	29
PID 1780 wrote to memory of 668	1780	cmd.exe	29
PID 1780 wrote to memory of 668	1780	cmd.exe	29
PID 1380 wrote to memory of 1528	1380	update.exe	35
PID 1380 wrote to memory of 1528	1380	update.exe	35
PID 1380 wrote to memory of 1528	1380	update.exe	35
PID 1380 wrote to memory of 1804	1380	update.exe	34
PID 1380 wrote to memory of 1804	1380	update.exe	34
PID 1380 wrote to memory of 1804	1380	update.exe	34
PID 1804 wrote to memory of 1708	1804	cmd.exe	32
PID 1804 wrote to memory of 1708	1804	cmd.exe	32
PID 1804 wrote to memory of 1708	1804	cmd.exe	32
PID 1528 wrote to memory of 744	1528	cmd.exe	31
PID 1528 wrote to memory of 744	1528	cmd.exe	31
PID 1528 wrote to memory of 744	1528	cmd.exe	31

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocks application from running via registry modification
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete swprv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\sc.exe
    sc delete swprv
    3⤵
    - Launches sc.exe
    PID:668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
  2⤵
  PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
  2⤵
  PID:1180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
  2⤵
  PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
  2⤵
  PID:964
- C:\ProgramData\Setup\Game.exe
  C:\ProgramData\Setup\Game.exe -pnaxui
  2⤵
  PID:1124
- - C:\ProgramData\RealtekHD\GameGuard.exe
    "C:\ProgramData\RealtekHD\GameGuard.exe"
    3⤵
    PID:1476
- - C:\ProgramData\RealtekHD\taskhost.exe
    "C:\ProgramData\RealtekHD\taskhost.exe"
    3⤵
    PID:880

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state on
1⤵
- Modifies Windows Firewall
PID:744

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:1708

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:1952

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
1⤵
- Modifies Windows Firewall
PID:780

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
1⤵
- Modifies Windows Firewall
PID:1276

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
1⤵
- Modifies Windows Firewall
PID:1384

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RealtekHD\GameGuard.exe

Filesize
5.0MB

MD5
32198d6a8e26f4e103885fc4eef3c2d7

SHA1
f35a0abab275eececc6410f69c5d041d14f3684e

SHA256
fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1

SHA512
d25eaad411040c4b3dc8892594c717d820a0e2dc2bc10d68217a52351764691c8e1e17bc55c1e67fe550e3ffde1e01ab60e6dae8f75b5e1c182733bbc950485e

Download Submit
C:\ProgramData\RealtekHD\GameGuard.exe

Filesize
4.2MB

MD5
fcdfefbc0f29afb1444ba648174b7182

SHA1
dfeff4394896cd700e9364dd930c62e1744c30de

SHA256
ce833f5fbcb230f6b7a4efdd97a7d44ddb5b530298473c10e2805b43d7d91977

SHA512
779bc54bb72ccfebc7b5f9845f56108f7f017c32baf45c91bbefcdc570684991c0049a96d893228288573a422504d31cb69442dcb002429f80eea5f5d48e643e

Download Submit
C:\ProgramData\RealtekHD\taskhost.exe

Filesize
6.2MB

MD5
2522b6629f0462e8a1a3f6dda6bdc031

SHA1
b5f298a26a9625b5babd496b34703fed2736f2b6

SHA256
8e05ed626d21b7157490a92be742d4687d2b7f534fb13ca2eebeb979c9cd39aa

SHA512
4ac0e8e2d7c467d114514e39eac21f503edd9d685b05baed206e27a64d77d34ba0fd41ec7c0045a6f1565213d06a362fe1b1d1d875846e9a6288bace562c3b79

Download Submit
C:\ProgramData\RealtekHD\taskhost.exe

Filesize
6.0MB

MD5
2defe16d485c9b891454cbf1dc40b412

SHA1
75cb67662073745b08ef2aa2146c838e21d0c63f

SHA256
2f7fda1049c4748336f3e2c4011e0ec1a62ba83bc9786b3069335ba487d606fd

SHA512
ad076bdc2196683f970aa8846c4cd9dd9c6bf0c8500ba23a467575ef6f52e6390b170109e08dfeb2d3e1ef795522c8ee80e661e9aa4c9cb96eeaa1d2af76b8d5

Download Submit
C:\ProgramData\Setup\Game.exe

Filesize
8.4MB

MD5
b1c1f1f7654212a26c820bb8d98b060c

SHA1
18a48261a0c2c38fdc249905f72efe7f65ad2c57

SHA256
f4e81f05aa5c0371231b60210f42afe6ffe9fdde05a1bf5c6609fa95c61d40b7

SHA512
c965553aff374d9f839186abcc3682996f3628682bf548bfc49151b82da8d297fc91a957150969b656d0c41170bd42fb0d38f1b3b1bf83e02065dfc8b07838b2

Download Submit
C:\ProgramData\Setup\Game.exe

Filesize
8.1MB

MD5
85c2020cb64c507c0a7fa9d5b2e966a6

SHA1
2d984e00bd3f9823276102de26d11b8db8ca23f6

SHA256
58b7adda1858eb651ff030bda70a613d03a5a69ed137cfa77acbf309bbcb659f

SHA512
0809172753be193f5811bfe675bd0b79f6d6a0d3831e06a1f78476b3ddb54633e9399594da8c74405193a5abc29b3dfbc241e58f705c50df504280d3245216ec

Download Submit
\ProgramData\RealtekHD\GameGuard.exe

Filesize
5.0MB

MD5
32198d6a8e26f4e103885fc4eef3c2d7

SHA1
f35a0abab275eececc6410f69c5d041d14f3684e

SHA256
fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1

SHA512
d25eaad411040c4b3dc8892594c717d820a0e2dc2bc10d68217a52351764691c8e1e17bc55c1e67fe550e3ffde1e01ab60e6dae8f75b5e1c182733bbc950485e

Download Submit
\ProgramData\RealtekHD\GameGuard.exe

Filesize
5.0MB

MD5
32198d6a8e26f4e103885fc4eef3c2d7

SHA1
f35a0abab275eececc6410f69c5d041d14f3684e

SHA256
fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1

SHA512
d25eaad411040c4b3dc8892594c717d820a0e2dc2bc10d68217a52351764691c8e1e17bc55c1e67fe550e3ffde1e01ab60e6dae8f75b5e1c182733bbc950485e

Download Submit
\ProgramData\RealtekHD\GameGuard.exe

Filesize
4.0MB

MD5
31513526b143dfeee251948797984ea1

SHA1
2123bb1d02088b69cabcc554fb1fa531d660eb29

SHA256
c12c07ec3b48481e5c8a5f3505ac288c0a6a5b3627299af3175372e391346e20

SHA512
571c2b87aa97e0dc1f032b3e54548d406f57c665e87280f59d1edfeee3a2a32e74df68a5b5a322061fb288440fe996c921407272496d80eb711a6031bad698b2

Download Submit
\ProgramData\RealtekHD\taskhost.exe

Filesize
5.5MB

MD5
e851bc9b590b9eef91122a475da8e8ec

SHA1
8ded89b8a184b029422637c68a9d985d070c16d7

SHA256
b92d212ae2193ee5f8bf70d9830c7009f51c232419a21c88ed696921097f9a01

SHA512
06ff884db6c7576d6e3df569b26a80cd70e7a808bccb3535e7760ca4c7ff07357d88835609ba653d70e6af2dc9ae86f2a1026eb96f46516a09c19cb9d10c8720

Download Submit
\ProgramData\RealtekHD\taskhost.exe

Filesize
5.4MB

MD5
374f4aad40de8f1ca2d97d1304d469ee

SHA1
4ba1b3b1f5e3d641bbd1484dc6d00bdc11af68a0

SHA256
1ad53cb03047dcc99a368f82029e01ad7795bce8504b315aa78851f18e4f9520

SHA512
a521369eaeb52fa3d3182b54591216a5270cfc0ad53e5c8beee0d69c47b05c290ad340befe4b6346464c3d163660424501577127ff9273227f645cc925e40b89

Download Submit
\ProgramData\RealtekHD\taskhost.exe

Filesize
6.4MB

MD5
aa4796c6f97290be934849bdd782fcda

SHA1
3388340def67668cbb64ab01be0c6d80c618399b

SHA256
ef5114a20d122583ae6ccc2b19fee23bad302190a2f0883e558e36cd786f5e99

SHA512
154319605ea28613b7edc881cfa9a74f197406691ab110fbbf54aee16e0edbb5b73e562a969beb6e256c44f75f7b6189973c9fcb342257975e9531c0a737006f

Download Submit
memory/880-121-0x000000013F1B0000-0x00000001424D2000-memory.dmp

Filesize
51.1MB

Download
memory/880-117-0x000000013F1B0000-0x00000001424D2000-memory.dmp

Filesize
51.1MB

Download
memory/880-123-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/1124-92-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-59-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-56-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/1380-57-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-66-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/1380-55-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-65-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-64-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-63-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1380-58-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-62-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-61-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1380-60-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1464-105-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1464-106-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1464-122-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1464-119-0x000000013F2A0000-0x0000000143563000-memory.dmp

Filesize
66.8MB

Download
memory/1476-112-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-118-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-111-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-126-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/1476-113-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-114-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-115-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-116-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-125-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download
memory/1476-120-0x000000013FF40000-0x0000000140B08000-memory.dmp

Filesize
11.8MB

Download