09bb73b82c2c50e3de03fc1f00e703d2a4fabcb777ef51bade09e0f142b24bb2

Analysis

max time kernel
63s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2023, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

trojan-remover-6-9-5-build-2982.exe
Size

14.7MB
MD5

9ea5babf6100f16074566aef293b41fa
SHA1

e640da514782aa7e10534eb94e7292d6ef9b7f7c
SHA256

09bb73b82c2c50e3de03fc1f00e703d2a4fabcb777ef51bade09e0f142b24bb2
SHA512

7cef8cd181313bb1cf58edf3c15444dfc28f520013f93fe4a27818e8c3542bb7adcb155031aa9039dbf6c38db3decc3c5a31eb8453ecfdaa1487b06621fc7a0d
SSDEEP

393216:gML27lzHSgAsU7WWBIia6iZuXiCSOefVytt6o0LHAm6:NulzygAsguiYkAtyPqgm6

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rmvtrjan.exe	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rmvtrjan.exe\MitigationOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rmvtrjan.exe\MitigationOptions = 000200000000000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rmvtrjan.exe\MitigationAuditOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rmvtrjan.exe\EAFModules	powershell.exe
Key created	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Trojan Remover\is-553MM.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-U2RER.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-GNG2R.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-KO56Q.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-FNBLQ.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-OPENV.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-RQELI.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\Win32\is-T3HMJ.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-E9RVQ.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-3UU7V.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-LIQMB.tmp	trojan-remover-6-9-5-build-2982.tmp
File opened for modification	C:\Program Files (x86)\Trojan Remover\unins000.dat	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\unins000.dat	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-3KEI3.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-V1JN2.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\is-FRSDM.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\Win32\is-H4MKE.tmp	trojan-remover-6-9-5-build-2982.tmp
File created	C:\Program Files (x86)\Trojan Remover\unins000.msg	trojan-remover-6-9-5-build-2982.tmp

Executes dropped EXE 3 IoCs

pid	Process
4768	trojan-remover-6-9-5-build-2982.tmp
5112	TaskInst.exe
4108	trupd.exe

Loads dropped DLL 5 IoCs

pid	Process
840	regsvr32.exe
672	regsvr32.exe
4564	regsvr32.exe
4108	trupd.exe
4108	trupd.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\ShellEx\ContextMenuHandlers\Trojan Remover	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\Trojan Remover	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\Trojan Remover\ = "{52B87208-9CCF-42C9-B88E-069281105805}"	regsvr32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\InprocServer32\ = "C:\\PROGRA~2\\TROJAN~1\\TRSHLE~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\InprocServer32	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\ = "TRElevationHelper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Trshlex64.TRShellEx\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\TypeLib\ = "{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TRPrivilegesLib.TRElevationHelper\ = "TRElevationHelper"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Trshlex64.TRShellEx\ = "Trojan Remover Shell Extension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0\0\win32\ = "C:\\Program Files (x86)\\Trojan Remover\\TRElevationHelper.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\AppID = "{518932EE-5045-451E-BDE5-B864132BE471}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TRElevationHelper.dll\AppID = "{518932EE-5045-451E-BDE5-B864132BE471}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{008F705E-B937-4E1F-8FF8-C4D68AA3A67B}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A5CDBAE-FB8C-4406-8CBE-54C7AEDAA2B5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{518932EE-5045-451E-BDE5-B864132BE471}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\InprocServer32\ = "C:\\PROGRA~2\\TROJAN~1\\TRELEV~2.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\TypeLib\ = "{008F705E-B937-4E1F-8FF8-C4D68AA3A67B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A5CDBAE-FB8C-4406-8CBE-54C7AEDAA2B5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Trojan Remover\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\ = "ITRPrivilegedObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}\ = "ITRPrivilegedObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\InprocServer32\ = "C:\\PROGRA~2\\TROJAN~1\\TRSHLE~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5EE211E-46A8-4019-BF37-AD5C8FF3D39D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TRElevationHelper.TRPrivilegedObject\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\LocalizedString = "@C:\\Program Files (x86)\\Trojan Remover\\TRElevationHelper.dll,-65014"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{008F705E-B937-4E1F-8FF8-C4D68AA3A67B}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A5CDBAE-FB8C-4406-8CBE-54C7AEDAA2B5}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Trshlex64.TRShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0\ = "TRElevationHelper Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\InprocServer32\ = "C:\\PROGRA~2\\TROJAN~1\\TRELEV~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A5CDBAE-FB8C-4406-8CBE-54C7AEDAA2B5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A5CDBAE-FB8C-4406-8CBE-54C7AEDAA2B5}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TRPrivilegesLib.TRElevationHelper\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\ShellEx\ContextMenuHandlers\Trojan Remover	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{008F705E-B937-4E1F-8FF8-C4D68AA3A67B}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{008F705E-B937-4E1F-8FF8-C4D68AA3A67B}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B87A5C78-0783-4F35-B2BA-90F45E1E2C37}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\LocalizedString = "@C:\\Program Files (x86)\\Trojan Remover\\TRElevationHelper32.dll,-65056"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{518932EE-5045-451E-BDE5-B864132BE471}\DllSurrogate	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A5CDBAE-FB8C-4406-8CBE-54C7AEDAA2B5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C47CD61-C5D9-4A1B-8D3E-AD7D6435196E}\ProgID\ = "TRPrivilegesLib.TRElevationHelper"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{008F705E-B937-4E1F-8FF8-C4D68AA3A67B}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Trojan Remover\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\TRElevationHelper32.dll	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52B87208-9CCF-42C9-B88E-069281105805}\ProgID\ = "Trshlex64.TRShellEx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{518932EE-5045-451E-BDE5-B864132BE471}\ = "TRPrivilegedObject"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe
4108	trupd.exe
4108	trupd.exe
4108	trupd.exe
4108	trupd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4768	trojan-remover-6-9-5-build-2982.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4108	trupd.exe
4108	trupd.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4768	1560	trojan-remover-6-9-5-build-2982.exe	82
PID 1560 wrote to memory of 4768	1560	trojan-remover-6-9-5-build-2982.exe	82
PID 1560 wrote to memory of 4768	1560	trojan-remover-6-9-5-build-2982.exe	82
PID 4768 wrote to memory of 840	4768	trojan-remover-6-9-5-build-2982.tmp	89
PID 4768 wrote to memory of 840	4768	trojan-remover-6-9-5-build-2982.tmp	89
PID 4768 wrote to memory of 672	4768	trojan-remover-6-9-5-build-2982.tmp	90
PID 4768 wrote to memory of 672	4768	trojan-remover-6-9-5-build-2982.tmp	90
PID 4768 wrote to memory of 672	4768	trojan-remover-6-9-5-build-2982.tmp	90
PID 4768 wrote to memory of 4564	4768	trojan-remover-6-9-5-build-2982.tmp	91
PID 4768 wrote to memory of 4564	4768	trojan-remover-6-9-5-build-2982.tmp	91
PID 4768 wrote to memory of 4564	4768	trojan-remover-6-9-5-build-2982.tmp	91
PID 4768 wrote to memory of 3892	4768	trojan-remover-6-9-5-build-2982.tmp	92
PID 4768 wrote to memory of 3892	4768	trojan-remover-6-9-5-build-2982.tmp	92
PID 4768 wrote to memory of 5112	4768	trojan-remover-6-9-5-build-2982.tmp	95
PID 4768 wrote to memory of 5112	4768	trojan-remover-6-9-5-build-2982.tmp	95
PID 4768 wrote to memory of 5112	4768	trojan-remover-6-9-5-build-2982.tmp	95
PID 4768 wrote to memory of 4108	4768	trojan-remover-6-9-5-build-2982.tmp	96
PID 4768 wrote to memory of 4108	4768	trojan-remover-6-9-5-build-2982.tmp	96
PID 4768 wrote to memory of 4108	4768	trojan-remover-6-9-5-build-2982.tmp	96

C:\Users\Admin\AppData\Local\Temp\trojan-remover-6-9-5-build-2982.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-remover-6-9-5-build-2982.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\is-KQQ6E.tmp\trojan-remover-6-9-5-build-2982.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KQQ6E.tmp\trojan-remover-6-9-5-build-2982.tmp" /SL5="$C005E,14611967,499712,C:\Users\Admin\AppData\Local\Temp\trojan-remover-6-9-5-build-2982.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Trojan Remover\Trshlex64.dll"
    3⤵
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Modifies registry class
    PID:840
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Trojan Remover\TRElevationHelper.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:672
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Trojan Remover\TRElevationHelper32.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4564
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Set-ProcessMitigation -Name rmvtrjan.exe -Disable ForceRelocateImages
    3⤵
    - Sets file execution options in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\is-KEHHM.tmp\TaskInst.exe
    "C:\Users\Admin\AppData\Local\Temp\is-KEHHM.tmp\TaskInst.exe"
    3⤵
    - Executes dropped EXE
    PID:5112
- - C:\Program Files (x86)\Trojan Remover\trupd.exe
    "C:\Program Files (x86)\Trojan Remover\trupd.exe" /dbinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Trojan Remover\TRElevationHelper.dll

Filesize
1.0MB

MD5
4af801176ac79f0a2a32b2d71d6ef691

SHA1
e4ad5d68fbd01d31d13e3737879c5adfaa05518b

SHA256
f0cd8bcd09a72de3bd900776fb129416877df869f27e8b2a1bb86d04ca8856f1

SHA512
dffb0ad4ea97fdfd58642eeeec6c2138de8cf5f2562e72d4503fe8da40b020595aa3e3cd5c4d1522335b9d64e8b83871f8c54365dbc2b6d2ee50e11df78d42c4

Download Submit
C:\Program Files (x86)\Trojan Remover\TRElevationHelper.dll

Filesize
1.0MB

MD5
4af801176ac79f0a2a32b2d71d6ef691

SHA1
e4ad5d68fbd01d31d13e3737879c5adfaa05518b

SHA256
f0cd8bcd09a72de3bd900776fb129416877df869f27e8b2a1bb86d04ca8856f1

SHA512
dffb0ad4ea97fdfd58642eeeec6c2138de8cf5f2562e72d4503fe8da40b020595aa3e3cd5c4d1522335b9d64e8b83871f8c54365dbc2b6d2ee50e11df78d42c4

Download Submit
C:\Program Files (x86)\Trojan Remover\TRElevationHelper32.dll

Filesize
2.2MB

MD5
4214adca95cec26e3cf661678a6c3705

SHA1
57604b65ef8ca91927dcfe2b4cf8ca0b4e0f1286

SHA256
03c6998fc83a8b89deb233e571e0ae1a5c07905578304440a06b5a912cc20700

SHA512
c0e980dab170caa2cad8b04bb34d12a65378e4d925efe2a3d3b9eb8a66ae487c573c6d6ba2d6565005f90defcf93e93273b1e6650b049ad3f250af5d3a14e084

Download Submit
C:\Program Files (x86)\Trojan Remover\TRElevationHelper32.dll

Filesize
2.2MB

MD5
4214adca95cec26e3cf661678a6c3705

SHA1
57604b65ef8ca91927dcfe2b4cf8ca0b4e0f1286

SHA256
03c6998fc83a8b89deb233e571e0ae1a5c07905578304440a06b5a912cc20700

SHA512
c0e980dab170caa2cad8b04bb34d12a65378e4d925efe2a3d3b9eb8a66ae487c573c6d6ba2d6565005f90defcf93e93273b1e6650b049ad3f250af5d3a14e084

Download Submit
C:\Program Files (x86)\Trojan Remover\Trshlex64.dll

Filesize
3.4MB

MD5
bc168257a6d847002c942f725e6c4d45

SHA1
252e52be7982fd7cf69ed1ae0d7b9d5246b76cae

SHA256
8332bd218920b6bec2a043ca6409d672335c0269b2d437cd7c1b00456e6f1726

SHA512
3ebad8455a440eb5bb87503fea557e3e30f136a461199bf66aa4ad11307d4dd52914469c59f0c8627310221f80c6048beada8275358c4db5c89eb4de26e16732

Download Submit
C:\Program Files (x86)\Trojan Remover\Trshlex64.dll

Filesize
3.4MB

MD5
bc168257a6d847002c942f725e6c4d45

SHA1
252e52be7982fd7cf69ed1ae0d7b9d5246b76cae

SHA256
8332bd218920b6bec2a043ca6409d672335c0269b2d437cd7c1b00456e6f1726

SHA512
3ebad8455a440eb5bb87503fea557e3e30f136a461199bf66aa4ad11307d4dd52914469c59f0c8627310221f80c6048beada8275358c4db5c89eb4de26e16732

Download Submit
C:\Program Files (x86)\Trojan Remover\Win32\libeay32.dll

Filesize
1.3MB

MD5
de66601165d003a7dbe444b128461694

SHA1
b6daca91c628bfeac760fb41f22ac591a6bb98e3

SHA256
ed98fc88dfe77719474dbe680cafdb1ec1ff6311513ac4e2cf233f7520ec59ef

SHA512
21812241e34ff8b3cc98add32df719aa4947d6d7250dbaec9c4135b51c8e017f0d108da22ece878d0a59289433fb286d9ae9dc82ae34f4f5af2b1e8f8f27378f

Download Submit
C:\Program Files (x86)\Trojan Remover\Win32\libeay32.dll

Filesize
1.3MB

MD5
de66601165d003a7dbe444b128461694

SHA1
b6daca91c628bfeac760fb41f22ac591a6bb98e3

SHA256
ed98fc88dfe77719474dbe680cafdb1ec1ff6311513ac4e2cf233f7520ec59ef

SHA512
21812241e34ff8b3cc98add32df719aa4947d6d7250dbaec9c4135b51c8e017f0d108da22ece878d0a59289433fb286d9ae9dc82ae34f4f5af2b1e8f8f27378f

Download Submit
C:\Program Files (x86)\Trojan Remover\Win32\ssleay32.dll

Filesize
350KB

MD5
9f487404116e9718f3b62bad39891488

SHA1
efedbce65290163364db72796ea38331c605b063

SHA256
e04f10dc724496de19c5201d045e7951e5d508e71c13139523cdc42ed96707cc

SHA512
f56bf9df702a37dd625f5732bf8a0d24c8259d2ba4cbfb3b1ee9d48aeaed27eb485032b3bd4ba28e8d51b102daa5e14712aca40af43d1141b160968303e52d53

Download Submit
C:\Program Files (x86)\Trojan Remover\Win32\ssleay32.dll

Filesize
350KB

MD5
9f487404116e9718f3b62bad39891488

SHA1
efedbce65290163364db72796ea38331c605b063

SHA256
e04f10dc724496de19c5201d045e7951e5d508e71c13139523cdc42ed96707cc

SHA512
f56bf9df702a37dd625f5732bf8a0d24c8259d2ba4cbfb3b1ee9d48aeaed27eb485032b3bd4ba28e8d51b102daa5e14712aca40af43d1141b160968303e52d53

Download Submit
C:\Program Files (x86)\Trojan Remover\trupd.exe

Filesize
6.4MB

MD5
259c6fc84a6095e4a1d4e2242e2ceda1

SHA1
3992009312d8650ba787251c28b1fe6616304e19

SHA256
389f0fd6b713d894b624e114728c3a4dba971bbe2af0cee16d237f9ae5451bf0

SHA512
ef2843818922e16ffc55e2265416ac4669b1f198b961ec46c2f9f32e73263fd7a5aae7494a642a95a1ecedf447a75e2f48e335cafddde90bd40375066029b8c7

Download Submit
C:\Program Files (x86)\Trojan Remover\trupd.exe

Filesize
6.4MB

MD5
259c6fc84a6095e4a1d4e2242e2ceda1

SHA1
3992009312d8650ba787251c28b1fe6616304e19

SHA256
389f0fd6b713d894b624e114728c3a4dba971bbe2af0cee16d237f9ae5451bf0

SHA512
ef2843818922e16ffc55e2265416ac4669b1f198b961ec46c2f9f32e73263fd7a5aae7494a642a95a1ecedf447a75e2f48e335cafddde90bd40375066029b8c7

Download Submit
C:\ProgramData\Simply Super Software\Trojan Remover\Data\dlservers.dta

Filesize
522B

MD5
11da9dbdee7dd02901cddaed4841802b

SHA1
a53152510c5f81e423355deda4502abc29ea8af7

SHA256
11956755580ed92378df8fb11cccf980ec134943c6a2e08581dcbf6b770411f9

SHA512
137985e2dde65c70056ac618fcb617ead6d9ce75bfadb25310ca45c5c6670663b8ecd8218b7ce2beb8022c7847a48a607f5725df48e05b56282ecc5d2e8992aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npepqqg5.2gb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KEHHM.tmp\TaskInst.exe

Filesize
2.3MB

MD5
0ea8f3f88f2433777d6d950978d71e3e

SHA1
7dfeecbb71a8a6fd65735e9b967692de09d67d2a

SHA256
b53fad3e0294a5b364b2aa85de3e651c9b39b290b6545698374435982def5bb1

SHA512
ca367d10ea7c94e110958b3f1c6a1cd939acce4c7f4ccfe4212e704534a667abf376cdd45f9610bb39cf9bc042fb23781073a67146fdf86ff55b3669264e284a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KQQ6E.tmp\trojan-remover-6-9-5-build-2982.tmp

Filesize
1.5MB

MD5
4aaacbe93ee7ad2d86fe3533068ade70

SHA1
01c3403b90d4c43fa07a13c89035a9a78c2b62c1

SHA256
1e10e564609c79febd65d446fd40f865413d7d82e92836e5ca6c6c0d4ba08d7d

SHA512
ca132148954d30b76a1652e9cce63d7a15adfb3017d25c5acec97d4b59a591e9ee592f0938adb5a6d62bbf7a38865807eb9cfbbc6dbaed3707b937822162ab75

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KQQ6E.tmp\trojan-remover-6-9-5-build-2982.tmp

Filesize
1.5MB

MD5
4aaacbe93ee7ad2d86fe3533068ade70

SHA1
01c3403b90d4c43fa07a13c89035a9a78c2b62c1

SHA256
1e10e564609c79febd65d446fd40f865413d7d82e92836e5ca6c6c0d4ba08d7d

SHA512
ca132148954d30b76a1652e9cce63d7a15adfb3017d25c5acec97d4b59a591e9ee592f0938adb5a6d62bbf7a38865807eb9cfbbc6dbaed3707b937822162ab75

Download Submit
memory/1560-133-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1560-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3892-216-0x000002442EA30000-0x000002442EA40000-memory.dmp

Filesize
64KB

Download
memory/3892-217-0x000002442EA30000-0x000002442EA40000-memory.dmp

Filesize
64KB

Download
memory/3892-218-0x000002442EA30000-0x000002442EA40000-memory.dmp

Filesize
64KB

Download
memory/3892-215-0x0000024416560000-0x000002441657E000-memory.dmp

Filesize
120KB

Download
memory/3892-207-0x00000244163A0000-0x00000244163C2000-memory.dmp

Filesize
136KB

Download
memory/4108-228-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/4108-229-0x00000000030F0000-0x00000000033FA000-memory.dmp

Filesize
3.0MB

Download
memory/4768-187-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/4768-142-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/4768-141-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/4768-138-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/5112-223-0x0000000000400000-0x000000000066E000-memory.dmp

Filesize
2.4MB

Download