Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral11

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231201-en

Max time kernel

140s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

N/A

Files

memory/2528-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2528-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2528-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2528-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231127-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3932 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp
PID 3932 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp
PID 3932 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp" /SL5="$B0040,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	41.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	158.240.127.40.in-addr.arpa	udp
US	8.8.8.8:53	9.228.82.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.200:443	g.bing.com	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	39.142.81.104.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	59.128.231.4.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	121.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	90.65.42.20.in-addr.arpa	udp

Files

memory/3932-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3932-2-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp

MD5	c765336f0dcf4efdcc2101eed67cd30c
SHA1	fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256	c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512	06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

C:\Users\Admin\AppData\Local\Temp\is-CPKFR.tmp\butterflyondesktop.tmp

MD5	c765336f0dcf4efdcc2101eed67cd30c
SHA1	fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256	c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512	06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/4036-7-0x0000000002240000-0x0000000002241000-memory.dmp

memory/3932-13-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4036-14-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/4036-17-0x0000000002240000-0x0000000002241000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231127-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	59.128.231.4.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	158.240.127.40.in-addr.arpa	udp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	121.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	112.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	1.173.189.20.in-addr.arpa	udp

Files

memory/3600-0-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/3600-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-2-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-3-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/3600-4-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-5-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-7-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-9-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-10-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-11-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-12-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-13-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-14-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3600-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231129-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231130-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA8C2.tmp	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA8D8.tmp	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1312 wrote to memory of 4248	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 4248	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 4248	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 4248 wrote to memory of 3456	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 4248 wrote to memory of 3456	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 4248 wrote to memory of 3456	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 1312 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 32	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 32	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 32	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 3984	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 3984	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 3984	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 1224	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 1224	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 1224	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1312 wrote to memory of 4080	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 4080	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 4080	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 3732	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 928 wrote to memory of 3732	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 928 wrote to memory of 3732	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1312 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3732 wrote to memory of 3360	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 3732 wrote to memory of 3360	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 3732 wrote to memory of 3360	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 3360 wrote to memory of 2804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3360 wrote to memory of 2804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3360 wrote to memory of 2804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 51441701761932.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	2.136.104.51.in-addr.arpa	udp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	39.142.81.104.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
US	8.8.8.8:53	59.128.231.4.in-addr.arpa	udp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	121.175.53.84.in-addr.arpa	udp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp

Files

memory/1312-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\u.wry

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\51441701761932.bat

MD5	71e08345a9f96647941595bc404e4304
SHA1	207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256	04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512	5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5	897fe8eafbce679f3f2ecae2f678753a
SHA1	3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256	04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512	979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5	82ca0a2f2fd1604fe087fea68a3de0d7
SHA1	c1d9a713796c0715a2358eb7eb374868da80690a
SHA256	ee1bb8e3d4223aa5e24643a6923ac07fc01fce8f570e0c31555c39cbf79a5dc8
SHA512	3d25575fe47d2e1aeb54d3bdf621835e4e34d322726e4449efb2593669559d69caa2e13be3b232fde348403198bd191b5bbe0300c9e71e224fee0aed68467d78

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5	a4f846fe51f357b3766870c86bdada01
SHA1	36978ba3daf28169b30a3c91b3097684ac28ab17
SHA256	1fe753823516799e89a49463c41c6a287729746f44bd77869b5f99c01123f58a
SHA512	1a39c25bb827007fc504fe92ec8e4cbea12a316104d889b9ebe095587c631b4a81a987930dba91cfe7f2509ca73e50ef414be67fce18d7a7357cb266d089ee80

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5	89f756f46fd6a0c0f4cb806365095748
SHA1	49a8c192d60217f5ed4db890e2a790c5cf48f485
SHA256	1f88911e2db53ef515cffc60307804ef9d8fb7aeba144e891e6dbc8ca37968fa
SHA512	a4fa6fe364f0175d48d082ae747c77cfbee15ef752217c8c7d816875ec618d63be9f0fe47483fdb5cfbd5ac3411ec835e3acdf5eb187f2de1bdccf59e23ec972

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

MD5	afa18cf4aa2660392111763fb93a8c3d
SHA1	c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256	227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512	4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

MD5	82ca0a2f2fd1604fe087fea68a3de0d7
SHA1	c1d9a713796c0715a2358eb7eb374868da80690a
SHA256	ee1bb8e3d4223aa5e24643a6923ac07fc01fce8f570e0c31555c39cbf79a5dc8
SHA512	3d25575fe47d2e1aeb54d3bdf621835e4e34d322726e4449efb2593669559d69caa2e13be3b232fde348403198bd191b5bbe0300c9e71e224fee0aed68467d78

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5	a4f846fe51f357b3766870c86bdada01
SHA1	36978ba3daf28169b30a3c91b3097684ac28ab17
SHA256	1fe753823516799e89a49463c41c6a287729746f44bd77869b5f99c01123f58a
SHA512	1a39c25bb827007fc504fe92ec8e4cbea12a316104d889b9ebe095587c631b4a81a987930dba91cfe7f2509ca73e50ef414be67fce18d7a7357cb266d089ee80

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5	02b0b38ed807445badcf3588643e3529
SHA1	42cbeb8c4221a9116c6817562eb7d1a1e532b3bb
SHA256	0a58af1af280c726650fa98f6d1f6a89f609f215211b48829f90bd76e9be575d
SHA512	2863e218759c81d32cdcbc1dced600c2086000c40f840bc7ae0bda999e66aad17c9762c45702e5882ad2cff28d7c191baa9347565fa6247acd6b9dfb3124b805

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5	980b08bac152aff3f9b0136b616affa5
SHA1	2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256	402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512	100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5	d288ba831e64e78786dc769a663f5f5b
SHA1	33371b923a45fd74ee50199924f04c3dfc68a940
SHA256	e898c104f140df3e39c17e4f826811f399efba67a9591fe7b794785d46003449
SHA512	60ce42f106bba7013c31ddfa69f9ce6ccd09e53fcd190d35e43f26a182008a4aa515e01ffb4cec962dedbf813d5cfd7f7ff6a08dead6923fa991abc81793838e

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Analysis: behavioral19

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:39

Platform

win7-20231023-en

Max time kernel

27s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

UAC bypass

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\NetSh.exe	N/A

Sets file execution options in registry

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Checks whether UAC is enabled

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Drops autorun.inf file

Description	Indicator	Process	Target
File created	C:\autorun.inf	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
File opened for modification	C:\autorun.inf	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Nope.txt	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\shutdown.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\shutdown.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2756 wrote to memory of 1264	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 1264	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 1264	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\NetSh.exe
PID 2756 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\NetSh.exe
PID 2756 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\system32\NetSh.exe
PID 2756 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\System32\shutdown.exe
PID 2756 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\System32\shutdown.exe
PID 2756 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\System32\shutdown.exe

System policy modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2756-0-0x00000000001F0000-0x0000000000C8C000-memory.dmp

memory/2756-1-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

memory/2756-2-0x000000001BD00000-0x000000001CD16000-memory.dmp

memory/2756-3-0x0000000000DE0000-0x0000000000DE6000-memory.dmp

memory/2756-4-0x000000001BA70000-0x000000001BAF0000-memory.dmp

memory/2756-5-0x000000001BA70000-0x000000001BAF0000-memory.dmp

memory/2756-6-0x000000001BA70000-0x000000001BAF0000-memory.dmp

memory/2756-13-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

memory/2756-16-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

memory/1904-15-0x00000000029A0000-0x00000000029A1000-memory.dmp

memory/1892-17-0x00000000026E0000-0x00000000026E1000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	34.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	39.142.81.104.in-addr.arpa	udp
US	8.8.8.8:53	59.128.231.4.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.200:443	g.bing.com	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	208.194.73.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	138.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	41.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	48.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	209.143.182.52.in-addr.arpa	udp

Files

memory/3004-0-0x00007FFAFE640000-0x00007FFAFEFE1000-memory.dmp

memory/3004-1-0x0000000000D10000-0x0000000000D20000-memory.dmp

memory/3004-2-0x00007FFAFE640000-0x00007FFAFEFE1000-memory.dmp

memory/3004-3-0x000000001B440000-0x000000001B4E6000-memory.dmp

memory/3004-4-0x000000001B9C0000-0x000000001BE8E000-memory.dmp

memory/3004-5-0x000000001BF70000-0x000000001C00C000-memory.dmp

memory/3004-6-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

memory/3004-7-0x000000001C1D0000-0x000000001C21C000-memory.dmp

memory/3004-8-0x0000000000D10000-0x0000000000D20000-memory.dmp

memory/3004-9-0x00007FFAFE640000-0x00007FFAFEFE1000-memory.dmp

memory/3004-10-0x0000000000D10000-0x0000000000D20000-memory.dmp

memory/3004-11-0x00007FFAFE640000-0x00007FFAFEFE1000-memory.dmp

memory/3004-12-0x0000000000D10000-0x0000000000D20000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231020-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2952504676-3105837840-1406404655-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9cuugkzit.jpg"	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\NOTEPAD.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2108 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2108 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2108 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	C:\Users\Admin\AppData\Roaming\svchost.exe
PID 3048 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\System32\cmd.exe
PID 3048 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\System32\cmd.exe
PID 3048 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\System32\cmd.exe
PID 2660 wrote to memory of 1048	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2660 wrote to memory of 1048	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2660 wrote to memory of 1048	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2660 wrote to memory of 2956	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2660 wrote to memory of 2956	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2660 wrote to memory of 2956	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 3048 wrote to memory of 2296	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\system32\NOTEPAD.EXE
PID 3048 wrote to memory of 2296	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\system32\NOTEPAD.EXE
PID 3048 wrote to memory of 2296	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

N/A

Files

memory/2108-0-0x00000000001C0000-0x00000000001D0000-memory.dmp

memory/2108-1-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1	1895758de51ccfefa40239aa11055540c8c5deb7
SHA256	04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512	7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1	1895758de51ccfefa40239aa11055540c8c5deb7
SHA256	04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512	7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/3048-7-0x0000000000EF0000-0x0000000000F00000-memory.dmp

memory/3048-9-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

memory/2108-8-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

memory/3048-11-0x000000001AE90000-0x000000001AF10000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5	46fe77013e7336b17e5270cc708a1da4
SHA1	c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256	fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512	b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

MD5	46fe77013e7336b17e5270cc708a1da4
SHA1	c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256	fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512	b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/3048-454-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

memory/3048-455-0x000000001AE90000-0x000000001AF10000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231130-en

Max time kernel

141s

Max time network

50s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

Files

memory/4636-0-0x0000000002440000-0x0000000002441000-memory.dmp

memory/4636-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/4636-3-0x0000000002440000-0x0000000002441000-memory.dmp

memory/4636-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231020-en

Max time kernel

146s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD61C4.tmp	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\cscript.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\vssadmin.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 844 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2660	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 2756 wrote to memory of 2660	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 2756 wrote to memory of 2660	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 2756 wrote to memory of 2660	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 844 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 1872	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1872	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1872	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1872	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 2028	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2028	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2028	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2028	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 2768	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 2768	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 2768	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 2768	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Windows\SysWOW64\cmd.exe
PID 2768 wrote to memory of 2888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2768 wrote to memory of 2888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2768 wrote to memory of 2888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2768 wrote to memory of 2888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 844 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2888 wrote to memory of 600	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 600	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 600	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 600	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe	C:\Windows\SysWOW64\cmd.exe
PID 600 wrote to memory of 680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\vssadmin.exe
PID 600 wrote to memory of 680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\vssadmin.exe
PID 600 wrote to memory of 680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\vssadmin.exe
PID 600 wrote to memory of 680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\vssadmin.exe
PID 600 wrote to memory of 2104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 600 wrote to memory of 2104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 600 wrote to memory of 2104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 600 wrote to memory of 2104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c 104151701761929.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

Network

Country	Destination	Domain	Proto
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp
N/A	127.0.0.1:9050		tcp
N/A	127.0.0.1:9150		tcp

Files

memory/844-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\104151701761929.bat

MD5	71e08345a9f96647941595bc404e4304
SHA1	207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256	04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512	5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\104151701761929.bat

MD5	71e08345a9f96647941595bc404e4304
SHA1	207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256	04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512	5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5	897fe8eafbce679f3f2ecae2f678753a
SHA1	3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256	04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512	979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5	4fc3dd7e91dbdc3a812f892450fc5d65
SHA1	e8f29b1fa1840797054e8d79fb896c6a28c3833c
SHA256	72046acf80dd7f01fda7d1f9a5871bc9c1408f776ed581ca3fecbc9e4c4f56e0
SHA512	e24115d35590e7104761e74b1cf1113ddadc91af2d79e44d12e54d0e1feb64030259758d6e908678b8128c2b3183b7fd9d88f644aef86bcbf60ce14caac76f41

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5	663e55df21852bc8870b86bc38e58262
SHA1	1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA256	bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
SHA512	6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5	d8392e69a20886a9c2b6510a3dfb15a4
SHA1	2dbb1d3fcdabc64759144215a1c6091088438cba
SHA256	9a862eeb290214b9e3fb9fbecfc5ec6cc0dbace6f2af1037ec8ffd01a3c4ebe7
SHA512	890c82829663076efc6b9768b90cc026cc19962816dd0bdafc17f5ce93448af9d3e0949f9b9fb7ad465a52ca350d58424a8a998601c3b6c4230c4bc434b3dc1a

C:\Users\Admin\Documents\!Please Read Me!.txt

MD5	afa18cf4aa2660392111763fb93a8c3d
SHA1	c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256	227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512	4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\!WannaDecryptor!.exe.lnk

MD5	4fc3dd7e91dbdc3a812f892450fc5d65
SHA1	e8f29b1fa1840797054e8d79fb896c6a28c3833c
SHA256	72046acf80dd7f01fda7d1f9a5871bc9c1408f776ed581ca3fecbc9e4c4f56e0
SHA512	e24115d35590e7104761e74b1cf1113ddadc91af2d79e44d12e54d0e1feb64030259758d6e908678b8128c2b3183b7fd9d88f644aef86bcbf60ce14caac76f41

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5	0750513ece3b63d8160fe0eb3abfcae9
SHA1	3f766b9e5cbd9b838145d98a632ce2162a3ae386
SHA256	99102fdfd173581d228530945d2481cd867ae744f049146b940163dec82f07f9
SHA512	e36ad54da9b85c12368e36ceeae7347aec069651c3a006b625ef65cd216d94b6e2905842c7d29d14f74fceab251e1a4ff25a742943ecccb286127433b2069d71

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5	9f6331cc9134d9cde25dc1d07b460a1d
SHA1	7a811c8aa0fb23a2a19d033fc66b0f403e86951b
SHA256	2392734a94a226570f3f28ca426dedb6f493aea720ebc5bdf84f7f338a07cc60
SHA512	7a937da4b9ae1111c21f8bc2afbeb556ca4af4e445baddf212a66f439eef78e5872e7644754cf83e903d07dd8065fbd80ee6eb465998f5ae472af0866e4292ce

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5	cf1416074cd7791ab80a18f9e7e219d9
SHA1	276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256	78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512	0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5	980b08bac152aff3f9b0136b616affa5
SHA1	2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256	402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512	100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5	ea5b9fae5bc90ef9fcdf33475edcd4b4
SHA1	c38f1cde2791784d3d2aa19261ac305dcd5e2b99
SHA256	ffa35ccda43999a585247e35d8149f718dba28a6212565cf68aa8cc81d5c9fc9
SHA512	02398ecf9dba102f02495c4b174f3b99d724c0f03bc7b9882d9fec490b9591aa55cb57d232ebf74eacfe49089188ff98039031ce100dbe5fafa791efc88ab487

Analysis: behavioral18

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:38

Platform

win10v2004-20231130-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PHYSICALDRIVE0	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	N/A
File opened for modification	\??\PHYSICALDRIVE0	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "103"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	C:\Windows\system32\LogonUI.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\LogonUI.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4556 wrote to memory of 4300	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4556 wrote to memory of 4300	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4556 wrote to memory of 4300	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39a1855 /state1:0x41c64e6d

Network

Files

memory/4556-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5	70108103a53123201ceb2e921fcfe83c
SHA1	c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256	9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512	996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5	70108103a53123201ceb2e921fcfe83c
SHA1	c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256	9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512	996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/4556-5-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5	89f10072ebabf67c196f4c140e5b5349
SHA1	e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256	da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512	eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

Analysis: behavioral20

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:39

Platform

win10v2004-20231127-en

Max time kernel

34s

Max time network

39s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

UAC bypass

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\NetSh.exe	N/A

Sets file execution options in registry

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Checks whether UAC is enabled

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Drops autorun.inf file

Description	Indicator	Process	Target
File created	C:\autorun.inf	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
File opened for modification	C:\autorun.inf	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Nope.txt	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "111"	C:\Windows\system32\LogonUI.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\shutdown.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\shutdown.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\LogonUI.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1652 wrote to memory of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 4892	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3160	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3160	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3816	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3816	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\NetSh.exe
PID 1652 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\SYSTEM32\NetSh.exe
PID 1652 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\System32\shutdown.exe
PID 1652 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	C:\Windows\System32\shutdown.exe

System policy modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe	N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39be855 /state1:0x41c64e6d

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	107.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	39.142.81.104.in-addr.arpa	udp
US	8.8.8.8:53	2.136.104.51.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.200:443	g.bing.com	tcp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	22.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	59.128.231.4.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	121.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	153.141.79.40.in-addr.arpa	udp

Files

memory/1652-0-0x0000022D591D0000-0x0000022D59C6C000-memory.dmp

memory/1652-1-0x00007FFAE0600000-0x00007FFAE10C1000-memory.dmp

memory/1652-2-0x0000022D740A0000-0x0000022D750B6000-memory.dmp

memory/1652-3-0x0000022D5B7C0000-0x0000022D5B7C6000-memory.dmp

memory/1652-4-0x0000022D5B930000-0x0000022D5B940000-memory.dmp

memory/1652-5-0x0000022D5B930000-0x0000022D5B940000-memory.dmp

memory/1652-13-0x00007FFAE0600000-0x00007FFAE10C1000-memory.dmp

memory/1652-15-0x00007FFAE0600000-0x00007FFAE10C1000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231130-en

Max time kernel

140s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

N/A

Files

memory/2344-0-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2344-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2344-14-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231025-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\Butterfly on Desktop\is-J2IER.tmp	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
File created	C:\Program Files (x86)\Butterfly on Desktop\is-IMTUH.tmp	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
File created	C:\Program Files (x86)\Butterfly on Desktop\is-D6SRA.tmp	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
File created	C:\Program Files (x86)\Butterfly on Desktop\is-72FUH.tmp	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "32"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "0"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4076"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4094"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "3998"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "4076"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "32"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "4076"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\NumberOfSubdomains = "1"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "3962"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "0"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3962"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "3962"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98BE5D91-9341-11EE-937D-EE8D2C4A14D5} = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "3998"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3998"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	N/A
N/A	N/A	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 1792 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp
PID 3064 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 3064 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 3064 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 3064 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 3064 wrote to memory of 2916	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files\Internet Explorer\iexplore.exe
PID 3064 wrote to memory of 2916	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files\Internet Explorer\iexplore.exe
PID 3064 wrote to memory of 2916	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files\Internet Explorer\iexplore.exe
PID 3064 wrote to memory of 2916	N/A	C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp	C:\Program Files\Internet Explorer\iexplore.exe
PID 2916 wrote to memory of 1996	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 1996	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 1996	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 1996	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp" /SL5="$70122,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://freedesktopsoft.com/butterflyondesktoplike.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	freedesktopsoft.com	udp
DE	78.46.117.95:80	freedesktopsoft.com	tcp
DE	78.46.117.95:80	freedesktopsoft.com	tcp
DE	78.46.117.95:80	freedesktopsoft.com	tcp
DE	78.46.117.95:80	freedesktopsoft.com	tcp
DE	78.46.117.95:80	freedesktopsoft.com	tcp
NL	142.251.31.113:80	www.google-analytics.com	tcp
NL	142.251.31.113:80	www.google-analytics.com	tcp
US	8.8.8.8:53	connect.facebook.net	udp
US	157.240.5.10:80	connect.facebook.net	tcp
US	157.240.5.10:80	connect.facebook.net	tcp
US	157.240.5.10:443	connect.facebook.net	tcp
US	8.8.8.8:53	googleads.g.doubleclick.net	udp
DE	172.217.23.194:443	googleads.g.doubleclick.net	tcp
DE	172.217.23.194:443	googleads.g.doubleclick.net	tcp
DE	172.217.23.194:443	googleads.g.doubleclick.net	tcp
US	8.8.8.8:53	tpc.googlesyndication.com	udp
US	8.8.8.8:53	www.googletagservices.com	udp
US	8.8.8.8:53	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-if-v6exp3-v4.metric.gstatic.com	udp
GB	216.58.208.98:443	www.googletagservices.com	tcp
NL	142.251.36.1:443	tpc.googlesyndication.com	tcp
NL	142.251.36.1:443	tpc.googlesyndication.com	tcp
GB	216.58.208.98:443	www.googletagservices.com	tcp
NL	142.251.36.1:443	tpc.googlesyndication.com	tcp
NL	142.251.36.3:443	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-if-v6exp3-v4.metric.gstatic.com	tcp
NL	142.251.36.1:443	tpc.googlesyndication.com	tcp
NL	142.251.36.3:443	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-if-v6exp3-v4.metric.gstatic.com	tcp
NL	142.251.36.1:443	tpc.googlesyndication.com	tcp
US	8.8.8.8:53	www.facebook.com	udp
NL	157.240.247.35:443	www.facebook.com	tcp
NL	157.240.247.35:443	www.facebook.com	tcp
US	8.8.8.8:53	static.xx.fbcdn.net	udp
US	8.8.8.8:53	scontent.xx.fbcdn.net	udp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	157.240.5.10:443	scontent.xx.fbcdn.net	tcp
US	8.8.8.8:53	fe0.google.com	udp
US	8.8.8.8:53	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-841894-i1-v6exp3.ds.metric.gstatic.com	udp
US	8.8.8.8:53	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-841894-i2-v6exp3.v4.metric.gstatic.com	udp
NL	142.251.36.50:443	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-841894-i1-v6exp3.ds.metric.gstatic.com	tcp
NL	142.251.36.50:443	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-841894-i1-v6exp3.ds.metric.gstatic.com	tcp
NL	142.250.179.178:443	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-841894-i2-v6exp3.v4.metric.gstatic.com	tcp
NL	142.250.179.178:443	p4-cljqgfxlsp7jw-tmnxgtpkjbdosyeh-841894-i2-v6exp3.v4.metric.gstatic.com	tcp

Files

memory/1792-1-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp

MD5	c765336f0dcf4efdcc2101eed67cd30c
SHA1	fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256	c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512	06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp

MD5	c765336f0dcf4efdcc2101eed67cd30c
SHA1	fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256	c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512	06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/3064-8-0x0000000000240000-0x0000000000241000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-ER57K.tmp\_isetup\_shfoldr.dll

MD5	92dc6ef532fbb4a5c3201469a5b5eb63
SHA1	3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256	9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512	9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-ER57K.tmp\_isetup\_shfoldr.dll

MD5	92dc6ef532fbb4a5c3201469a5b5eb63
SHA1	3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256	9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512	9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/1792-16-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3064-17-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/3064-20-0x0000000000240000-0x0000000000241000-memory.dmp

memory/3064-38-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-SVBB4.tmp\butterflyondesktop.tmp

MD5	c765336f0dcf4efdcc2101eed67cd30c
SHA1	fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256	c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512	06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5	81aab57e0ef37ddff02d0106ced6b91e
SHA1	6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256	a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512	a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5	81aab57e0ef37ddff02d0106ced6b91e
SHA1	6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256	a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512	a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

\Program Files (x86)\Butterfly on Desktop\unins000.exe

MD5	1fee4db19d9f5af7834ec556311e69dd
SHA1	ff779b9a3515b5a85ab27198939c58c0ad08da70
SHA256	3d550c908d5a8de143c5cd5f4fe431528cd5fa20b77f4605a9b8ca063e83fc36
SHA512	306652c0c4739fce284e9740397e4c8924cd31b6e294c18dd42536d6e00ad8d4c93d9642fe2408f54273d046f04f154f25948936930dd9c81255f3726f31ee65

\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5	81aab57e0ef37ddff02d0106ced6b91e
SHA1	6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256	a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512	a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5	81aab57e0ef37ddff02d0106ced6b91e
SHA1	6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256	a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512	a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5	81aab57e0ef37ddff02d0106ced6b91e
SHA1	6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256	a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512	a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

memory/2428-66-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3064-70-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/1792-71-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab15D4.tmp

MD5	f3441b8572aae8801c04f3060b550443
SHA1	4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256	6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512	5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar1713.tmp

MD5	9c0c641c06238516f27941aa1166d427
SHA1	64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256	4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512	936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IS81ELR0\freedesktopsoft[1].xml

MD5	c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1	35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256	b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512	6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IS81ELR0\freedesktopsoft[1].xml

MD5	cd12b0836d9a7436627ed71ecc624b8d
SHA1	ca25935cfc848b70053f81b18dc76889d9121199
SHA256	23edcd5c6702180e6c57b496e9496058096bd86b12c86ef6c49a3afd4584bd16
SHA512	85e83021c0557761cb43a55d5bbd59d231cb0adb6f48afe99917ce167718f540a0e85bcf8c56f2cb9da4a3a297ca02f2f156e994ca4051dd4c752342c6b95e63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_B021D4AEB02A09712A509444D6DD147F

MD5	0e899c1411e11c8869f94490f5416daf
SHA1	694b168308c1d3b6999f74b86207ecf908b9a3a4
SHA256	fd9720bf89c7b993e8848a8c453ad0e3c98d9114c773e7bd54f20cf6f1cbd2b0
SHA512	3a837e1bdb8594fa900b480f3ec6660fd46e62a6daf04fda70ccaabe1110d9df6452fa5dbe674006ecf0434798807c9337501d7aa395d6f09d76c3bd5227daa7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_B021D4AEB02A09712A509444D6DD147F

MD5	93ff9d8aef14b9eaad737532cb00aad6
SHA1	c25d1e6db8ca7ddb901afd77e889336fa943fec0
SHA256	1a0b537a453f43a1361113d7aaa3079948bf2fc6183de9e53ff60d56dc3ca9be
SHA512	8b4072c9f10bbef6c40ece5b6187af263a4986705e8ba53182d50032d42495fa9dc38894afdf3ef52a4fc8adeba01505e948fefb319f53fb59f1d8b5a3a15c3d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNDI6Z3B\f[1].txt

MD5	82ff8f6d177d6bceabfd12c21f797595
SHA1	31ec08a7032b528bcc48a86722755e4c99f397ec
SHA256	f84f4f65c00630a8dd0f354e652293a2cf51e95722f447fb2ea869bbbe664446
SHA512	c5c509f9c31ace75a67381fed073d3bd963be90cb19c6e3ab6984790f34ea299afdc909bd23e290c9711e48ecdc5b22f97bb6f4a6a59c758f69fa38f07cb9a8e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MQDFJ88W\f[2].txt

MD5	43df87d5c0a3c601607609202103773a
SHA1	8273930ea19d679255e8f82a8c136f7d70b4aef2
SHA256	88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a
SHA512	2162ab9334deebd5579ae218e2a454dd7a3eef165ecdacc7c671e5aae51876f449de4ac290563ecc046657167671d4a9973c50d51f7faefc93499b8515992137

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9G8QJ0N4\f[2].txt

MD5	1a19b293e026e10fa30034f7f85a3219
SHA1	85e0267d67b10b1b117c41b033698704acd2b3f2
SHA256	1a9715e1af7ac7b2f65f32a853e2da82c6a584a53f45cec9061ba96e2d11949a
SHA512	f6587a6cee9b5856f33e88adbd280e28b5c3218d1807dfa1f880ed8134710aaaa271d2a8afc8cadb160c1f541e949d02197996224eed10f991a2102a72b330a7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TVQOT0Y\ufs_web_display[1].js

MD5	82f8e09973a0342fe3a4abef0885fd1a
SHA1	2432658b42c1008d4f41c4302f6c6f1c4fc1c525
SHA256	4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c
SHA512	6ec16edad5325700775374ebf39bcd5176820a33664e345f6b71dd085233411b761b1b4725fb88d1bdc6e3bf11e4dc95d85527b9b8b8ce1f2671563fd3901632

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MQDFJ88W\f[1].txt

MD5	4c94415208988a7b27a42059de663f18
SHA1	eb965354f8dee13c651207b7f31a1cc4b26b96c2
SHA256	0efaf29dbb93fbc3d780879be8247daf94ceaa7000b32fb036aeaa21257cf24e
SHA512	4caa4c3915533350c099b70ee06cbdbe08d3f628ba92497927fa4b6f8895fbf1c9a46478340e597e0d52c8c89eb32ad47910358408af22d58e65be2b05c49228

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TVQOT0Y\pBq_eaGNeQPMek60CnKWy_ILlX9gRsLLbk3WGYw_FYY[1].js

MD5	2f759d02216bdc9ca647538387472213
SHA1	ba9b941ba62d6c310589e9b71aaabf5ec60cb4a7
SHA256	a41abf79a18d7903cc7a4eb40a7296cbf20b957f6046c2cb6e4dd6198c3f1586
SHA512	4200051a06002a42a48d7793428dd386233dd1977a84f9de676f2ab4ba3ed759be93f3700d8b109461765c86507bf247aed39d8f9fce78fbb5764a8c12a57dca

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\pagsbca\imagestore.dat

MD5	96d2d7beb999d4817506d07d540137a8
SHA1	fba481ecd20b706f7525b24498b6caa1a1e6066c
SHA256	69f733f627944d3345dacd8dc795dfac2b80774159c087f3b9d9027a7088f729
SHA512	659b3acbbce827018fd0e0e2948c8f557902f9b155b40e1ae55fca2edce6a0e418de6ef80b444a1871aa3c9930fb4d07a3147bbd6699c0387b2729aa2282d1da

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNDI6Z3B\favicon[1].ico

MD5	972196f80fc453debb271c6bfdf1d1be
SHA1	01965ba3f3c61a9a23d261bc69f7ef5abe0b2dc3
SHA256	769684bc8078079c7c13898e1cccce6bc8ddec801bafde8a6aec2331c532f778
SHA512	cb74de07067d43477bd62ab7875e83da00fad5ac1f9f08b8b30f5ebb14b1da720e0af5867b6e4ab2a02acd93f4134e26d9f1a56c896da071fc23a4241dc767f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	6524c65558f0bbebbec63fb493d7afd0
SHA1	825558abc45be340e4455d1d668d8e16835f00a3
SHA256	7e9f28c341870afeb65f7620fc6d9b8ba5cd7158495d6c40e1e5bfb01af9cb93
SHA512	524fda7510dd63016893acf8112c2f9b299b1a88ce16754825590b0208ab4bb586209988618b93892033bea57fe4e9e1034e19b803530d685f27747d113a9a39

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	e56117d5f066e5ea6cbf1d7d06f46d84
SHA1	122966bd4396143ef46391370c2ad88fcbd26426
SHA256	d82523d5f6bdf45ed5ae30269739dbcdeaaf1b60486c7e5b6aa7f187284e69e7
SHA512	308a4991f860074aa49b12a8151a20a45e8bf0e81d643d3f893cf947e3eaa628161dd324cfcd86ddc71274b490cab91f339d7622f7e0985c8a7c8eccc078d862

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	323131d9bdaa34fa9f0d8d35be3bcb0b
SHA1	1729881c39d0260cb5c376ac679080e941eba1d3
SHA256	10555294df04213c95700a2fe8cec150aec895e74ccabdd30002307f06140c10
SHA512	76cb01908be0f4626c3c346add07acb423099e0b3ca45f3482f5e0460f9f3acc6aaf175ba1fea4653e75e9aec3065092edd293b3f02c811a465d9d4149d881d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	654d4c808f715d2a2d5133d7b6b7083f
SHA1	f344bbbcb716c6005d82ff05414247fccf946daa
SHA256	f72fd33a14e8ed071df20cefb745bcc91e6e1e2962be6d6bc00d285afdce8fa2
SHA512	d152a800cc2fadd0bb222852f9b48af27bd9eea68b89af480ea86bcdfdbeab8fd53d5d4f67e7a5192c063c242b84b5281c6ac4ae1ccb3d2e2236e020036a47da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	cb48b862508f1dab291e8e3dd39b7cf6
SHA1	ac3b75831944a626d4f4557c8032e977e73947fd
SHA256	d130faf272c0f2259357c0b0788f00480455700b1356c5d1fa0ac0cef40d796f
SHA512	9757ae51325ebdc77804d5528263c2ddc992b0712a3a378d7c9c2201f448e6da60ae9e2e431afb92b19ffed707f793169820ac334da6f842e9d95077264fa476

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	0f59f9f4d5917d968f261d95875cc5b2
SHA1	1d4c973022befab5bd096ffcca42f9e1f1e339fb
SHA256	f92f3452aa351240a76cd6eda6a6fc3411328c1e3a36d8471a7d89cce930ab64
SHA512	1fbca2494881703a697706f024cc42234f151b875aaf2ad1db60716419f947408d93590330dd1aecca2e43539b400d1c9f1695dab9e1b9f71df194dd149baee9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	d3d0a8301bab426b9bf8cdea05b7dbae
SHA1	0a696004c5551bd07edafd1e0a6db44a6db999da
SHA256	b933dce6a05e6b6ec87f6aba5bf37c3473dd4a520fb169cb183e3cd44062f3ea
SHA512	123210ef075ff0db4416f09315bbdb618db0411ffedd1ebc2171a46c76266a8f88844e5c21e2290b2ecbcbe51f4fb2a16901e7f2dd339370fb1d223f132ce711

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	e33361b03e28151d1ffbabe2f72eb4a9
SHA1	ccfdabb8efde0b20d85beeb201122738010a3cc4
SHA256	675388726ceb90d34d629628057a31e416a65214f9b39bb9bb27f1543f070714
SHA512	74dd7979356986f48c5c3864d7cfa5d7ea3053aed809e5ca671c9f53caf16fa3fb9ad166b5c0068c30af94483a7b7795953fe4dce05755818a82122afacced74

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	2c8fb487441b3be70a5e155014b370b2
SHA1	841482dcee965d90713080a7ba1b4f045aad09a5
SHA256	216412e40c78ec7aa07f09fe9d64691fa5ce061f2f5123ad5a8a02eb76997ef3
SHA512	cdbe17078d07f96ce7f619344c317ba1dde3b55f85e46dba85c5d659583920723569747b6c42ff4cbc680fb5cfbccca4899365e7e7e38fe948946917e9c5085b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	2d41bc95eab74c470e22157bd923f260
SHA1	1c7809735a8a8d5ca3f7c24eb483ce57f24786d7
SHA256	26d53f97a35f551c3a114a7b00312296b6476b9c429dc5ef4bdd49c09019e0d5
SHA512	1f31d21d3467a48874be8539886c8b1e770b2193e47d43e8a8b923b7ff8f86f2b0f08783421efe51949d1d2c9dd6ca8934ee9ac0244b660ce9ee62430deadc40

memory/2428-696-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2428-795-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2428-796-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2428-797-0x0000000000400000-0x000000000070B000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231130-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Network

N/A

Files

memory/2784-0-0x0000000000CA0000-0x0000000001104000-memory.dmp

memory/2784-1-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/2784-2-0x000000001B1F0000-0x000000001B270000-memory.dmp

memory/2784-3-0x000000001B1F0000-0x000000001B270000-memory.dmp

memory/2784-5-0x00000000005C0000-0x00000000005CA000-memory.dmp

memory/2784-4-0x00000000005C0000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5	698ddcaec1edcf1245807627884edf9c
SHA1	c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256	cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512	a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/2784-11-0x000007FEEBB90000-0x000007FEEBF81000-memory.dmp

memory/2784-15-0x0000000002510000-0x000000000251A000-memory.dmp

memory/2784-13-0x0000000002510000-0x000000000251A000-memory.dmp

memory/2784-16-0x0000000002510000-0x000000000251A000-memory.dmp

memory/2784-17-0x0000000002510000-0x000000000251A000-memory.dmp

memory/2784-30-0x000007FEEF4B0000-0x000007FEEF5F3000-memory.dmp

memory/2784-32-0x0000000002530000-0x000000000253A000-memory.dmp

memory/2784-33-0x000007FF43B90000-0x000007FF43B9A000-memory.dmp

memory/2784-31-0x0000000002530000-0x000000000253A000-memory.dmp

memory/2784-34-0x0000000000C80000-0x0000000000C81000-memory.dmp

memory/2784-36-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/2784-37-0x000000001B1F0000-0x000000001B270000-memory.dmp

memory/2784-39-0x000000001B1F0000-0x000000001B270000-memory.dmp

memory/2784-40-0x00000000005C0000-0x00000000005CA000-memory.dmp

memory/2784-42-0x000007FEEBB90000-0x000007FEEBF81000-memory.dmp

memory/2784-41-0x00000000005C0000-0x00000000005CA000-memory.dmp

memory/2784-43-0x0000000002510000-0x000000000251A000-memory.dmp

memory/2784-44-0x0000000002530000-0x000000000253A000-memory.dmp

memory/2784-45-0x000007FEEF4B0000-0x000007FEEF5F3000-memory.dmp

memory/2784-46-0x0000000002530000-0x000000000253A000-memory.dmp

memory/2784-47-0x000007FF43B90000-0x000007FF43B9A000-memory.dmp

memory/2784-51-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/2784-52-0x000007FEEBB90000-0x000007FEEBF81000-memory.dmp

memory/2784-53-0x000007FEEF4B0000-0x000007FEEF5F3000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231023-en

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

N/A

Files

memory/2064-0-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

memory/2064-1-0x0000000000BA0000-0x0000000000C20000-memory.dmp

memory/2064-2-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

memory/2064-3-0x0000000000BA0000-0x0000000000C20000-memory.dmp

memory/2064-4-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

memory/2064-5-0x0000000000BA0000-0x0000000000C20000-memory.dmp

memory/2064-6-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:38

Platform

win7-20231201-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PHYSICALDRIVE0	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	N/A
File opened for modification	\??\PHYSICALDRIVE0	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\sys3.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2504 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2504 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2504 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2504 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe	C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2504-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

memory/2504-10-0x00000000001D0000-0x00000000001F4000-memory.dmp

memory/2504-9-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5	89f10072ebabf67c196f4c140e5b5349
SHA1	e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256	da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512	eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5	70108103a53123201ceb2e921fcfe83c
SHA1	c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256	9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512	996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5	70108103a53123201ceb2e921fcfe83c
SHA1	c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256	9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512	996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5	70108103a53123201ceb2e921fcfe83c
SHA1	c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256	9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512	996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5	70108103a53123201ceb2e921fcfe83c
SHA1	c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256	9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512	996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/2764-13-0x0000000002D90000-0x0000000002D91000-memory.dmp

memory/2628-14-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:39

Platform

win7-20231023-en

Max time kernel

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Modifies WinLogon

persistence

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Control Panel\Desktop\Wallpaper	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2360 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2776 wrote to memory of 2340	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2340	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2340	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2340	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2704	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2704	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2704	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2704	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2776 wrote to memory of 2976	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 2976	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 2976	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 2976	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 1908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 1908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 1908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2776 wrote to memory of 1908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2360-0-0x00000000748E0000-0x0000000074FCE000-memory.dmp

memory/2360-1-0x0000000000B90000-0x000000000123E000-memory.dmp

memory/2360-2-0x0000000000B50000-0x0000000000B90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5	a9401e260d9856d1134692759d636e92
SHA1	4141d3c60173741e14f36dfe41588bb2716d2867
SHA256	b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512	5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5	a9401e260d9856d1134692759d636e92
SHA1	4141d3c60173741e14f36dfe41588bb2716d2867
SHA256	b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512	5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2360-15-0x0000000000B50000-0x0000000000B90000-memory.dmp

memory/2360-16-0x00000000002F0000-0x00000000002FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5	9232120b6ff11d48a90069b25aa30abc
SHA1	97bb45f4076083fca037eee15d001fd284e53e47
SHA256	70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512	b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5	d2774b188ab5dde3e2df5033a676a0b4
SHA1	6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256	95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512	3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/2360-30-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/2360-32-0x0000000000A40000-0x0000000000A4A000-memory.dmp

memory/2360-33-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/2360-35-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

memory/2360-34-0x0000000000A40000-0x0000000000A4A000-memory.dmp

memory/2360-31-0x0000000000A40000-0x0000000000A4A000-memory.dmp

memory/2360-29-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/2360-28-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/2360-27-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/2360-26-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/2360-25-0x000000006B9A0000-0x000000006BCB2000-memory.dmp

memory/2360-36-0x0000000000970000-0x0000000000971000-memory.dmp

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5	9037ebf0a18a1c17537832bc73739109
SHA1	1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256	38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512	4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5	9037ebf0a18a1c17537832bc73739109
SHA1	1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256	38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512	4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5	6fbd6ce25307749d6e0a66ebbc0264e7
SHA1	faee71e2eac4c03b96aabecde91336a6510fff60
SHA256	e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512	35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2360-842-0x00000000748E0000-0x0000000074FCE000-memory.dmp

memory/2884-843-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/2360-844-0x00000000748E0000-0x0000000074FCE000-memory.dmp

memory/2360-846-0x0000000000A40000-0x0000000000A4A000-memory.dmp

memory/2360-848-0x0000000000AB0000-0x0000000000AB5000-memory.dmp

memory/2360-847-0x000000006B9A0000-0x000000006BCB2000-memory.dmp

memory/2360-845-0x0000000000B50000-0x0000000000B90000-memory.dmp

memory/2132-849-0x00000000026D0000-0x00000000026D1000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231130-en

Max time kernel

67s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-423100829-2271632622-1028104103-1000\{06CC056B-EC64-4A42-B9F5-E2A5837EE4DE}	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
Token: 33	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x40c 0x3f8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp

Files

memory/2196-0-0x00000000006D0000-0x0000000000B34000-memory.dmp

memory/2196-1-0x00007FFC3CBB0000-0x00007FFC3D671000-memory.dmp

memory/2196-2-0x0000000002D50000-0x0000000002D60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5	7050d5ae8acfbe560fa11073fef8185d
SHA1	5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256	cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512	a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/2196-13-0x0000000002D50000-0x0000000002D60000-memory.dmp

memory/2196-15-0x0000000002C60000-0x0000000002C68000-memory.dmp

memory/2196-16-0x0000000002D50000-0x0000000002D60000-memory.dmp

memory/2196-17-0x000000001E280000-0x000000001E2B8000-memory.dmp

memory/2196-18-0x000000001E240000-0x000000001E24E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5	063793e4ba784832026ec8bc3528f7f1
SHA1	687d03823d7ab8954826f753a645426cff3c5db4
SHA256	cb153cb703aea1ba1afe2614cffb086fa781646a285c5ac37354ee933a29cedd
SHA512	225910c24052dfdf7fca574b12ecef4eb68e990167010f80d7136f03ac6e7faa33233685cbf37b38ee626bb22ff3afeee39e597080e429be3ec241fb30af40c6

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5	698ddcaec1edcf1245807627884edf9c
SHA1	c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256	cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512	a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/2196-36-0x00007FFC3CBB0000-0x00007FFC3D671000-memory.dmp

memory/2196-37-0x0000000002D50000-0x0000000002D60000-memory.dmp

memory/2196-38-0x0000000002D50000-0x0000000002D60000-memory.dmp

memory/2196-39-0x0000000002D50000-0x0000000002D60000-memory.dmp

memory/2196-53-0x00007FFC3CBB0000-0x00007FFC3D671000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231130-en

Max time kernel

141s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp

Files

memory/1688-0-0x0000000002240000-0x0000000002241000-memory.dmp

memory/1688-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/1688-3-0x0000000002240000-0x0000000002241000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:38

Platform

win10v2004-20231130-en

Max time kernel

Max time network

10s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Modifies WinLogon

persistence

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\Desktop\Wallpaper	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3936660601-1848837011-2142350499-1000\{312DCC5C-E974-4083-A400-EC17828B0BBC}	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3548 wrote to memory of 1340	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 1340	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 1340	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 1340 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1340 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1340 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1340 wrote to memory of 1920	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1340 wrote to memory of 1920	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1340 wrote to memory of 1920	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1340 wrote to memory of 752	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1340 wrote to memory of 752	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1340 wrote to memory of 752	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1340 wrote to memory of 1748	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1340 wrote to memory of 1748	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1340 wrote to memory of 1748	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa399d855 /state1:0x41c64e6d

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

memory/3548-1-0x0000000000200000-0x00000000008AE000-memory.dmp

memory/3548-0-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/3548-2-0x0000000005290000-0x00000000052A0000-memory.dmp

memory/3548-3-0x00000000059C0000-0x0000000005F64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5	a9401e260d9856d1134692759d636e92
SHA1	4141d3c60173741e14f36dfe41588bb2716d2867
SHA256	b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512	5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/3548-11-0x0000000005290000-0x00000000052A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5	7050d5ae8acfbe560fa11073fef8185d
SHA1	5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256	cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512	a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3548-23-0x000000000B280000-0x000000000B28E000-memory.dmp

memory/3548-22-0x000000000B2B0000-0x000000000B2E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5	9232120b6ff11d48a90069b25aa30abc
SHA1	97bb45f4076083fca037eee15d001fd284e53e47
SHA256	70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512	b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/3548-29-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-33-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-35-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-32-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-31-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-36-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-37-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

memory/3548-38-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

memory/3548-40-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

memory/3548-42-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-39-0x000000000B340000-0x000000000B350000-memory.dmp

memory/3548-43-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

memory/3548-45-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

memory/3548-44-0x000000000B340000-0x000000000B350000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5	02aeb000fc895d24e56fb8ffaaf4a9b0
SHA1	15ceb2bc83370bc487c225aac368526bed4adc7f
SHA256	009ff332e5d5af7bc1a19a9a9116cb7d6a107d684004df1483d1a6cdd59ae411
SHA512	f4251933251a103f82f5a5b931592a96cb95f1fe74b16128432d3135b093b0c3e5eec13caca498698d9dba05ec1ad14058a76dd72d7d24b3e6bed5ae9a034fb7

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5	9037ebf0a18a1c17537832bc73739109
SHA1	1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256	38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512	4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5	9037ebf0a18a1c17537832bc73739109
SHA1	1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256	38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512	4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5	6fbd6ce25307749d6e0a66ebbc0264e7
SHA1	faee71e2eac4c03b96aabecde91336a6510fff60
SHA256	e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512	35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/3548-864-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/3548-865-0x0000000005290000-0x00000000052A0000-memory.dmp

memory/3548-866-0x0000000074740000-0x0000000074EF0000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win10v2004-20231127-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1067295379-1486014338-1703171060-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pjvvww1yt.jpg"	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\NOTEPAD.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1496 wrote to memory of 4012	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1496 wrote to memory of 4012	N/A	C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe	C:\Users\Admin\AppData\Roaming\svchost.exe
PID 4012 wrote to memory of 4368	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\System32\cmd.exe
PID 4012 wrote to memory of 4368	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\System32\cmd.exe
PID 4368 wrote to memory of 4244	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4368 wrote to memory of 4244	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4368 wrote to memory of 1672	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4368 wrote to memory of 1672	N/A	C:\Windows\System32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4012 wrote to memory of 4588	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\system32\NOTEPAD.EXE
PID 4012 wrote to memory of 4588	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	9.228.82.20.in-addr.arpa	udp
US	8.8.8.8:53	59.128.231.4.in-addr.arpa	udp
US	8.8.8.8:53	41.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	39.142.81.104.in-addr.arpa	udp
US	8.8.8.8:53	2.136.104.51.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	121.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	89.175.53.84.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	90.65.42.20.in-addr.arpa	udp

Files

memory/1496-0-0x00000000007E0000-0x00000000007F0000-memory.dmp

memory/1496-1-0x00007FF8DD130000-0x00007FF8DDBF1000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1	1895758de51ccfefa40239aa11055540c8c5deb7
SHA256	04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512	7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1	1895758de51ccfefa40239aa11055540c8c5deb7
SHA256	04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512	7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1	1895758de51ccfefa40239aa11055540c8c5deb7
SHA256	04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512	7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/4012-15-0x00007FF8DD130000-0x00007FF8DDBF1000-memory.dmp

memory/1496-14-0x00007FF8DD130000-0x00007FF8DDBF1000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5	46fe77013e7336b17e5270cc708a1da4
SHA1	c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256	fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512	b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

MD5	46fe77013e7336b17e5270cc708a1da4
SHA1	c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256	fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512	b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/4012-466-0x00007FF8DD130000-0x00007FF8DDBF1000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2023-12-05 07:38

Reported

2023-12-05 07:41

Platform

win7-20231201-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

N/A

Files

memory/2016-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2016-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/2016-3-0x0000000000220000-0x0000000000221000-memory.dmp

Sample ID	231205-jgmcvshh5x
Target	82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
SHA256	1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
Tags	wannacry persistence ransomware spyware stealer worm evasion trojan chaos bootkit discovery aspackv2

Malware Analysis Report

2024-08-06 15:39

Table of Contents