64b7bef6d66f0d8b5f099e0efa6419076ab124b1da94e7d0cd360657d6f8ff04

Resubmissions

09/01/2023, 22:46

230109-2qa1asgb298

09/01/2023, 22:42

230109-2mrhwagb258

Analysis

max time kernel
81s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Damned Setup.exe
Size 72.5MB
Sample230109-2qa1asgb29
SHA256 64b7bef6d66f0d8b5f099e0efa6419076ab124b1da94e7d0cd360657d6f8ff04
MD5 293b29b38bbf51549082a0b38cf798db
SHA1 9a2e4e2a8b2abf4da8bebb08cec6ec0da9f4df99
SHA512 0925a48a8b480eed31e04e9bcee0245ad7ee55a262ebd88e36362e0d06bd8fa44445ce7c56f8040062da9e78696762076bae2368cb3eac8b79ede87ce8b0a42a
SSDEEP 1572864:MatXn/nb0XpAUaKK3mrN+/IcY/rtwOie3toqkZU4TUzDh:Mo/b0ZAUZNA9YJ/twU4Tw
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
89	800	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
1484	Damned Setup.tmp
4592	Damned.exe
4032	Damned.exe
3488	Damned.exe

Loads dropped DLL 3 IoCs

pid	Process
4592	Damned.exe
4032	Damned.exe
3488	Damned.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Damned\is-O2IBQ.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-NHGEF.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.InputModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-725QQ.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-B4KBU.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-KI6I7.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-A9THF.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-RINA8.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-M6NBV.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-BNC36.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-VLUVA.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-1TL98.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.DSPGraphModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.Transactions.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.UnityAnalyticsModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-U2QOU.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-8QGOI.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-LO3RC.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-VDFLB.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.ServiceModel.Internals.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.Xml.Linq.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-V784L.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-S6J1U.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.Data.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.Diagnostics.StackTrace.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.JSONSerializeModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-J8350.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-HTB9K.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-NNLAM.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\Unity.TextMeshPro.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.Configuration.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\unins000.exe	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.TerrainPhysicsModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.TilemapModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.ClusterRendererModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.StreamingModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.AudioModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-OOJPV.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.Core.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.UnityConnectModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-QAPVP.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-GVD2I.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-H9NA7.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.CoreModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.UmbraModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-6OTCD.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-QH5VF.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\System.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-FC036.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-COJ2S.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-EFA05.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-HGK9D.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-I2S0L.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\unins000.dat	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.GridModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.PhysicsModule.dll	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.TerrainModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-O98DL.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-9NN3O.tmp	Damned Setup.tmp
File opened for modification	C:\Program Files (x86)\Damned\UnityEngine.ProfilerModule.dll	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-FA1EE.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-HCSSM.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-SBU3T.tmp	Damned Setup.tmp
File created	C:\Program Files (x86)\Damned\is-EQSN3.tmp	Damned Setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe\shell\open\command	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.exe\OpenWithProgids	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DamnedSetup.exe\DefaultIcon	Damned Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe\shell\open\command\ = "\"C:\\Program Files (x86)\\Damned\\Damned.exe\" \"%1\""	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\Damned.exe\SupportedTypes	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Damned Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\OpenWithProgids\DamnedSetup.exe	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe\shell\open	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DamnedSetup.exe\shell\open\command	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe\shell	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Damned.exe	Damned Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Damned.exe\SupportedTypes\.myp	Damned Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe\ = "Damned Setup"	Damned Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe\DefaultIcon\ = "C:\\Program Files (x86)\\Damned\\Damned.exe,0"	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Damned.exe\SupportedTypes	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DamnedSetup.exe	Damned Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DamnedSetup.exe	Damned Setup.tmp

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1484	Damned Setup.tmp
1484	Damned Setup.tmp
3948	powershell.exe
3948	powershell.exe
3192	powershell.exe
3192	powershell.exe
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
3480	powershell.exe
404	powershell.exe
404	powershell.exe
404	powershell.exe
3480	powershell.exe
3480	powershell.exe
3120	powershell.exe
3120	powershell.exe
2168	powershell.exe
2168	powershell.exe
1568	powershell.exe
1568	powershell.exe
1928	powershell.exe
1928	powershell.exe
2168	powershell.exe
3120	powershell.exe
1568	powershell.exe
1928	powershell.exe
1348	powershell.exe
1348	powershell.exe
1988	powershell.exe
1988	powershell.exe
1688	powershell.exe
1688	powershell.exe
1348	powershell.exe
4304	powershell.exe
4304	powershell.exe
1688	powershell.exe
1988	powershell.exe
4304	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
412	powershell.exe
412	powershell.exe
2212	powershell.exe
2212	powershell.exe
2384	powershell.exe
2384	powershell.exe
3932	powershell.exe
4688	powershell.exe
3724	powershell.exe
4688	powershell.exe
3932	Damned.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe
Token: 33	3948	powershell.exe
Token: 34	3948	powershell.exe
Token: 35	3948	powershell.exe
Token: 36	3948	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeIncreaseQuotaPrivilege	3192	powershell.exe
Token: SeSecurityPrivilege	3192	powershell.exe
Token: SeTakeOwnershipPrivilege	3192	powershell.exe
Token: SeLoadDriverPrivilege	3192	powershell.exe
Token: SeSystemProfilePrivilege	3192	powershell.exe
Token: SeSystemtimePrivilege	3192	powershell.exe
Token: SeProfSingleProcessPrivilege	3192	powershell.exe
Token: SeIncBasePriorityPrivilege	3192	powershell.exe
Token: SeCreatePagefilePrivilege	3192	powershell.exe
Token: SeBackupPrivilege	3192	powershell.exe
Token: SeRestorePrivilege	3192	powershell.exe
Token: SeShutdownPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeSystemEnvironmentPrivilege	3192	powershell.exe
Token: SeRemoteShutdownPrivilege	3192	powershell.exe
Token: SeUndockPrivilege	3192	powershell.exe
Token: SeManageVolumePrivilege	3192	powershell.exe
Token: 33	3192	powershell.exe
Token: 34	3192	powershell.exe
Token: 35	3192	powershell.exe
Token: 36	3192	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeIncreaseQuotaPrivilege	4632	powershell.exe
Token: SeSecurityPrivilege	4632	powershell.exe
Token: SeTakeOwnershipPrivilege	4632	powershell.exe
Token: SeLoadDriverPrivilege	4632	powershell.exe
Token: SeSystemProfilePrivilege	4632	powershell.exe
Token: SeSystemtimePrivilege	4632	powershell.exe
Token: SeProfSingleProcessPrivilege	4632	powershell.exe
Token: SeIncBasePriorityPrivilege	4632	powershell.exe
Token: SeCreatePagefilePrivilege	4632	powershell.exe
Token: SeBackupPrivilege	4632	powershell.exe
Token: SeRestorePrivilege	4632	powershell.exe
Token: SeShutdownPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeSystemEnvironmentPrivilege	4632	powershell.exe
Token: SeRemoteShutdownPrivilege	4632	powershell.exe
Token: SeUndockPrivilege	4632	powershell.exe
Token: SeManageVolumePrivilege	4632	powershell.exe
Token: 33	4632	powershell.exe
Token: 34	4632	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1484	Damned Setup.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1484	5024	Damned Setup.exe	82
PID 5024 wrote to memory of 1484	5024	Damned Setup.exe	82
PID 5024 wrote to memory of 1484	5024	Damned Setup.exe	82
PID 1484 wrote to memory of 4592	1484	Damned Setup.tmp	90
PID 1484 wrote to memory of 4592	1484	Damned Setup.tmp	90
PID 4592 wrote to memory of 960	4592	Damned.exe	93
PID 4592 wrote to memory of 960	4592	Damned.exe	93
PID 960 wrote to memory of 3276	960	cmd.exe	95
PID 960 wrote to memory of 3276	960	cmd.exe	95
PID 4592 wrote to memory of 3948	4592	Damned.exe	96
PID 4592 wrote to memory of 3948	4592	Damned.exe	96
PID 4592 wrote to memory of 3192	4592	Damned.exe	100
PID 4592 wrote to memory of 3192	4592	Damned.exe	100
PID 4032 wrote to memory of 3096	4032	Damned.exe	103
PID 4032 wrote to memory of 3096	4032	Damned.exe	103
PID 3096 wrote to memory of 4664	3096	cmd.exe	105
PID 3096 wrote to memory of 4664	3096	cmd.exe	105
PID 4032 wrote to memory of 4632	4032	Damned.exe	107
PID 4032 wrote to memory of 4632	4032	Damned.exe	107
PID 4592 wrote to memory of 404	4592	Damned.exe	109
PID 4592 wrote to memory of 404	4592	Damned.exe	109
PID 4032 wrote to memory of 3480	4032	Damned.exe	110
PID 4032 wrote to memory of 3480	4032	Damned.exe	110
PID 4592 wrote to memory of 4748	4592	Damned.exe	113
PID 4592 wrote to memory of 4748	4592	Damned.exe	113
PID 4592 wrote to memory of 3120	4592	Damned.exe	115
PID 4592 wrote to memory of 3120	4592	Damned.exe	115
PID 4592 wrote to memory of 1568	4592	Damned.exe	122
PID 4592 wrote to memory of 1568	4592	Damned.exe	122
PID 4592 wrote to memory of 2168	4592	Damned.exe	119
PID 4592 wrote to memory of 2168	4592	Damned.exe	119
PID 4032 wrote to memory of 1928	4032	Damned.exe	120
PID 4032 wrote to memory of 1928	4032	Damned.exe	120
PID 4592 wrote to memory of 3792	4592	Damned.exe	123
PID 4592 wrote to memory of 3792	4592	Damned.exe	123
PID 4032 wrote to memory of 1904	4032	Damned.exe	135
PID 4032 wrote to memory of 1904	4032	Damned.exe	135
PID 3792 wrote to memory of 2436	3792	cmd.exe	126
PID 3792 wrote to memory of 2436	3792	cmd.exe	126
PID 4032 wrote to memory of 1688	4032	Damned.exe	134
PID 4032 wrote to memory of 1688	4032	Damned.exe	134
PID 4032 wrote to memory of 1348	4032	Damned.exe	133
PID 4032 wrote to memory of 1348	4032	Damned.exe	133
PID 4032 wrote to memory of 1988	4032	Damned.exe	131
PID 4032 wrote to memory of 1988	4032	Damned.exe	131
PID 4592 wrote to memory of 4304	4592	Damned.exe	128
PID 4592 wrote to memory of 4304	4592	Damned.exe	128
PID 4592 wrote to memory of 4472	4592	Damned.exe	150
PID 4592 wrote to memory of 4472	4592	Damned.exe	150
PID 4032 wrote to memory of 636	4032	Damned.exe	148
PID 4032 wrote to memory of 636	4032	Damned.exe	148
PID 4472 wrote to memory of 3400	4472	cmd.exe	138
PID 4472 wrote to memory of 3400	4472	cmd.exe	138
PID 636 wrote to memory of 3596	636	cmd.exe	142
PID 636 wrote to memory of 3596	636	cmd.exe	142
PID 4592 wrote to memory of 1712	4592	Damned.exe	139
PID 4592 wrote to memory of 1712	4592	Damned.exe	139
PID 4032 wrote to memory of 4048	4032	Damned.exe	141
PID 4032 wrote to memory of 4048	4032	Damned.exe	141
PID 4032 wrote to memory of 800	4032	Damned.exe	146
PID 4032 wrote to memory of 800	4032	Damned.exe	146
PID 800 wrote to memory of 1840	800	cmd.exe	143
PID 800 wrote to memory of 1840	800	cmd.exe	143
PID 4032 wrote to memory of 1308	4032	Damned.exe	144

C:\Users\Admin\AppData\Local\Temp\Damned Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Damned Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\is-O4I53.tmp\Damned Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O4I53.tmp\Damned Setup.tmp" /SL5="$9002C,75086013,832512,C:\Users\Admin\AppData\Local\Temp\Damned Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Program Files (x86)\Damned\Damned.exe
    "C:\Program Files (x86)\Damned\Damned.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
      4⤵
      PID:4748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Windows\system32\findstr.exe
        
        findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
        5⤵
        
        PID:2436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
      4⤵
      PID:1712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4472

C:\Program Files (x86)\Damned\Damned.exe
"C:\Program Files (x86)\Damned\Damned.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
  2⤵
  PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636

C:\Program Files (x86)\Damned\Damned.exe
"C:\Program Files (x86)\Damned\Damned.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:2412
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:5024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:1876
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:4844
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
  2⤵
  PID:4056

C:\Windows\System32\reg.exe
C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
1⤵
PID:3400

C:\Windows\system32\findstr.exe
findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
1⤵
PID:3596

C:\Windows\System32\reg.exe
C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
1⤵
PID:1840

C:\Program Files (x86)\Damned\Damned.exe
"C:\Program Files (x86)\Damned\Damned.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:5092
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Damned.exe

Path C:\Program Files (x86)\Damned\Damned.exe
Size 74.8MB
SHA256 eedce39fb656cc23e734ca97ad63f1d7b7cbb726095b8b624d63cdcafdabdb1a
MD5 99c6c5ad5f78d2fb3f9d66cf2ad8ed52
SHA1 cd306b9e91ff2d1b108248421e3440a512168572
SHA512 85401fd7297d7beba6a9be707ee3ed53a739ae0abd0ffda650dc90178eef8727acfced4a244b178f60f69415a853e465804505b3d5d448e30d680dfe0598c942
SSDEEP 786432:D0LoCOn+2Bs4urYDNulLBiusrDwhqgIoKQb0UEgLJGZAUhiX3WnGgSjDBS3DND/s:DMoCm/BXwvkWIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Damned.exe

Path C:\Program Files (x86)\Damned\Damned.exe
Size 74.8MB
SHA256 eedce39fb656cc23e734ca97ad63f1d7b7cbb726095b8b624d63cdcafdabdb1a
MD5 99c6c5ad5f78d2fb3f9d66cf2ad8ed52
SHA1 cd306b9e91ff2d1b108248421e3440a512168572
SHA512 85401fd7297d7beba6a9be707ee3ed53a739ae0abd0ffda650dc90178eef8727acfced4a244b178f60f69415a853e465804505b3d5d448e30d680dfe0598c942
SSDEEP 786432:D0LoCOn+2Bs4urYDNulLBiusrDwhqgIoKQb0UEgLJGZAUhiX3WnGgSjDBS3DND/s:DMoCm/BXwvkWIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Damned.exe

Path C:\Program Files (x86)\Damned\Damned.exe
Size 74.8MB
SHA256 eedce39fb656cc23e734ca97ad63f1d7b7cbb726095b8b624d63cdcafdabdb1a
MD5 99c6c5ad5f78d2fb3f9d66cf2ad8ed52
SHA1 cd306b9e91ff2d1b108248421e3440a512168572
SHA512 85401fd7297d7beba6a9be707ee3ed53a739ae0abd0ffda650dc90178eef8727acfced4a244b178f60f69415a853e465804505b3d5d448e30d680dfe0598c942
SSDEEP 786432:D0LoCOn+2Bs4urYDNulLBiusrDwhqgIoKQb0UEgLJGZAUhiX3WnGgSjDBS3DND/s:DMoCm/BXwvkWIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Damned.exe

Path C:\Program Files (x86)\Damned\Damned.exe
Size 74.8MB
SHA256 eedce39fb656cc23e734ca97ad63f1d7b7cbb726095b8b624d63cdcafdabdb1a
MD5 99c6c5ad5f78d2fb3f9d66cf2ad8ed52
SHA1 cd306b9e91ff2d1b108248421e3440a512168572
SHA512 85401fd7297d7beba6a9be707ee3ed53a739ae0abd0ffda650dc90178eef8727acfced4a244b178f60f69415a853e465804505b3d5d448e30d680dfe0598c942
SSDEEP 786432:D0LoCOn+2Bs4urYDNulLBiusrDwhqgIoKQb0UEgLJGZAUhiX3WnGgSjDBS3DND/s:DMoCm/BXwvkWIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Damned.exe

Path C:\Program Files (x86)\Damned\Damned.exe
Size 66.1MB
SHA256 535136d486f74b16c6cd42a4a8303c9954fed69ccd1b4285bc1b88bcaf9b1dd2
MD5 06ca7aef240c3ca4f757528e8828d30a
SHA1 d5bd8571073b48eddbce4dffe2b53044ad870634
SHA512 4562816dad0e3000fa5b7c4400255805482cf8c6e1febb90433b2b0d313b7e8446837fce53776c1c0f296b176bfab9fb973506f044962292a821db997a6c6399
SSDEEP 786432:D0LoCOn+2Bs4urYDNulLBiusrDwhqgIoKQb0UEgLJGZAUhiX3WnGgSjDX:DMoCm/BXwvkWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 5a48860ad5bdf15d7a241aa16124163ec48adc0f0af758e43561ac07e4f163b2
MD5 5c3cc3c6ae2c1e0b92b502859ce79d0c
SHA1 bde46d0f91ad780ce5cba924f8d9f4c175c5b83d
SHA512 269b79931df92c30741c9a42a013cb24935887272ed8077653f0b6525793da52c5004c70329d8e0e7b2776fc1aba6e32da5dadf237ae42f7398fdf35a930663e
MD5 SHA1 SHA512

Submit Download