Malware Analysis Report

2024-08-06 15:36

Sample ID 231205-jjdthahh6w
Target 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
SHA256 1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
Tags
bootkit persistence wannacry ransomware spyware stealer worm evasion trojan chaos aspackv2
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518

Threat Level: Known bad

The file 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip was found to be: Known bad.

Malicious Activity Summary

bootkit persistence wannacry ransomware spyware stealer worm evasion trojan chaos aspackv2

Chaos

UAC bypass

Chaos Ransomware

Modifies Windows Defender Real-time Protection settings

Chaos family

Wannacry

Deletes shadow copies

Modifies boot configuration data using bcdedit

Modifies Windows Firewall

Sets file execution options in registry

Disables use of System Restore points

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Executes dropped EXE

ASPack v2.12-2.42

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Checks whether UAC is enabled

Drops desktop.ini file(s)

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Modifies WinLogon

Enumerates connected drives

Drops autorun.inf file

Sets desktop wallpaper using registry

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

System policy modification

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Kills process with taskkill

Opens file in notepad (likely ransom note)

Interacts with shadow copies

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Pre-OS Boot
T1542
Bootkit
T1542.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Pre-OS Boot
T1542
Bootkit
T1542.003
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Defacement
T1491
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-12-05 07:41

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231130-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

N/A

Files

memory/2820-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2820-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2820-3-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2820-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:42

Platform

win10v2004-20231127-en

Max time kernel

11s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "144" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1988 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1988 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa394c855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

memory/1988-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

memory/1988-7-0x000000002AA00000-0x000000002AA24000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231023-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD76D8.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2788 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2788 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2788 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 3048 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2044 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2044 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2044 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3048 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2076 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 1840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1920 wrote to memory of 1840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1920 wrote to memory of 1840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1920 wrote to memory of 1840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1920 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1920 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1920 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1920 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c 186711701762115.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

Network

Country Destination Domain Proto
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp

Files

memory/3048-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\186711701762115.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\186711701762115.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 5117d2763865a5aba7bdc1c1772e0b11
SHA1 d225ad5eee92b777a06b9dd4b83ab8bb79baa9a4
SHA256 6cd79e5cf9dbd2767e0c49affd81b696eae0bb5ea1b5ed8f582688b306c1b95e
SHA512 90677c8fc9d78cebe797d9af8488aee5c87a873a6c612c965e0a9c03495002b1f8e657c2a6653fb3250865092c088e87d02a75c40237f0b420b10995146f28d3

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 dbd5eaaf624a8a5856aed32e4a5ff3d7
SHA1 ce40d26dce03f7667df140b9a9a6c816a1cdcdb9
SHA256 cb3769898e821f3178db0b74d453f7772e1e7576e5abae680d4cc14dacc41c61
SHA512 9177fb41cc8751962a2d4c559311c10f12dab166d962dcd95058afa8330ea0807a22fa448e2f07cac9794c68309acfd19e689f50aea6eaa30d73c506d94ecf20

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 12a8add23e72bbfc3978bef41b1339cd
SHA1 7d9ac45c04d78712b6a8b87257c367ac731a52fc
SHA256 9c51a33107b146fee409ad88d939e7a52382d7b4dee77d367cd35efa21b1a147
SHA512 dcc315b065768011f874bccb2a41227943f9bc19700a6f024face877837f53e73d2abbcc4b2ee2067c7553322b3945056c5dc244680a29bc9a2e65998ebf4058

C:\Users\Admin\Documents\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\!WannaDecryptor!.exe.lnk

MD5 5117d2763865a5aba7bdc1c1772e0b11
SHA1 d225ad5eee92b777a06b9dd4b83ab8bb79baa9a4
SHA256 6cd79e5cf9dbd2767e0c49affd81b696eae0bb5ea1b5ed8f582688b306c1b95e
SHA512 90677c8fc9d78cebe797d9af8488aee5c87a873a6c612c965e0a9c03495002b1f8e657c2a6653fb3250865092c088e87d02a75c40237f0b420b10995146f28d3

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 dbd5eaaf624a8a5856aed32e4a5ff3d7
SHA1 ce40d26dce03f7667df140b9a9a6c816a1cdcdb9
SHA256 cb3769898e821f3178db0b74d453f7772e1e7576e5abae680d4cc14dacc41c61
SHA512 9177fb41cc8751962a2d4c559311c10f12dab166d962dcd95058afa8330ea0807a22fa448e2f07cac9794c68309acfd19e689f50aea6eaa30d73c506d94ecf20

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 43a835967e41481985ec656da9b1d179
SHA1 ee05f3d857f503be09f8177af5a778922be098f8
SHA256 50cbc811a708b51774406cbf1fa0c81241c4d9e757f476b45589d75f485f0d56
SHA512 3fb5c57bb7f3e0b0c9dbfb858934d2c6c4370380e9a4c0b2916cea656fb0b373414ad1d9575e3dfb830d186780806596caa5f7d19eb8e093fc9f66ce0965a771

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 9508b6db2ca41d5485bb66480238dce1
SHA1 426932cc004a4fa9acd9b6326aac045b0249077b
SHA256 255ed9108c74ededec84eba0e69df65f609097bda59e3b07c6e4bf9bb915d186
SHA512 f97b9bcbc6d8477d0d1e5b5963d42af787fb5a24ec4552c95ff3879f870cc5e8010f8faaf505c4364476223281e109a7ebd1b537d1248ccc00598d62292ea3bb

Analysis: behavioral20

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:42

Platform

win10v2004-20231127-en

Max time kernel

26s

Max time network

30s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "230" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3388 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3388 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3388 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3388 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3388 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3388 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 3388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 3388 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 3388 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3946055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 122.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

memory/3388-0-0x0000024393030000-0x0000024393ACC000-memory.dmp

memory/3388-1-0x00007FFE20410000-0x00007FFE20ED1000-memory.dmp

memory/3388-2-0x00000243AE1D0000-0x00000243AF1E6000-memory.dmp

memory/3388-3-0x0000024393E60000-0x0000024393E66000-memory.dmp

memory/3388-4-0x00000243AE1C0000-0x00000243AE1D0000-memory.dmp

memory/3388-5-0x00000243AE1C0000-0x00000243AE1D0000-memory.dmp

memory/3388-12-0x00000243AF320000-0x00000243AF4C9000-memory.dmp

memory/3388-15-0x00007FFE20410000-0x00007FFE20ED1000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231130-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2058106572-1146578376-825901627-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\h2h7ge5yq.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1744 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1744 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2360 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2360 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2360 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2624 wrote to memory of 2692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2624 wrote to memory of 2692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2624 wrote to memory of 2692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2624 wrote to memory of 2456 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2624 wrote to memory of 2456 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2624 wrote to memory of 2456 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2360 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2360 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2360 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

N/A

Files

memory/1744-0-0x00000000001A0000-0x00000000001B0000-memory.dmp

memory/1744-1-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/2360-7-0x0000000001260000-0x0000000001270000-memory.dmp

memory/2360-9-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

memory/1744-8-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/2360-11-0x000000001AC90000-0x000000001AD10000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/2360-433-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

memory/2360-434-0x000000001AC90000-0x000000001AD10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:42

Platform

win10v2004-20231130-en

Max time kernel

3s

Max time network

12s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1791582586-1997866593-3795608343-1000\{CEDBB315-980A-4640-AEEE-1A8E931FE719} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3356 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3356 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3356 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4768 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4768 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4768 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4768 wrote to memory of 3560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4768 wrote to memory of 3560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4768 wrote to memory of 3560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4768 wrote to memory of 408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4768 wrote to memory of 408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4768 wrote to memory of 408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4768 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4768 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4768 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b6855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/3356-1-0x0000000000B10000-0x00000000011BE000-memory.dmp

memory/3356-0-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/3356-2-0x0000000005B40000-0x0000000005B50000-memory.dmp

memory/3356-3-0x0000000006270000-0x0000000006814000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/3356-11-0x0000000005B40000-0x0000000005B50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/3356-23-0x000000000BB90000-0x000000000BB9E000-memory.dmp

memory/3356-22-0x000000000BBC0000-0x000000000BBF8000-memory.dmp

memory/3356-30-0x000000000C580000-0x000000000C590000-memory.dmp

memory/3356-32-0x000000000C580000-0x000000000C590000-memory.dmp

memory/3356-36-0x000000000C580000-0x000000000C590000-memory.dmp

memory/3356-37-0x000000000C580000-0x000000000C590000-memory.dmp

memory/3356-41-0x000000000C580000-0x000000000C590000-memory.dmp

memory/3356-40-0x000000000CBE0000-0x000000000CBF0000-memory.dmp

memory/3356-39-0x000000000CBE0000-0x000000000CBF0000-memory.dmp

memory/3356-38-0x000000000CBE0000-0x000000000CBF0000-memory.dmp

memory/3356-35-0x000000000CBE0000-0x000000000CBF0000-memory.dmp

memory/3356-34-0x000000000CBE0000-0x000000000CBF0000-memory.dmp

memory/3356-33-0x000000000C580000-0x000000000C590000-memory.dmp

memory/3356-31-0x000000000C580000-0x000000000C590000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 3f05c4104136fccfd74eddc0f1a8fc11
SHA1 0f84faca66da1bdbece28ff10eaef52d0dd460d7
SHA256 5c4e03bb71b2b9e4e4842c35a9f9e8242af81d5b051c1c4992a335bc4e12106c
SHA512 06bdd967b12f8edd38391a6eb463c7b19a89dcc651411b67270e2e2cd4492c8c49541cb9b6596d520e912802d97a73900415c0878f9af5dced2fd8260d27469d

memory/3356-29-0x000000000C580000-0x000000000C590000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/3356-860-0x0000000074ED0000-0x0000000075680000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231130-en

Max time kernel

125s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-423100829-2271632622-1028104103-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cyym05zsa.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2152 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1968 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1968 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4784 wrote to memory of 2448 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4784 wrote to memory of 2448 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4784 wrote to memory of 3352 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4784 wrote to memory of 3352 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1968 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 1968 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

Files

memory/2152-0-0x00000000001E0000-0x00000000001F0000-memory.dmp

memory/2152-1-0x00007FF8C6770000-0x00007FF8C7231000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/2152-14-0x00007FF8C6770000-0x00007FF8C7231000-memory.dmp

memory/1968-15-0x00007FF8C6770000-0x00007FF8C7231000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/1968-398-0x00007FF8C6770000-0x00007FF8C7231000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231130-en

Max time kernel

141s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4404 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp
PID 4404 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp
PID 4404 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp" /SL5="$C003E,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp

Files

memory/4404-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4404-2-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

C:\Users\Admin\AppData\Local\Temp\is-1UPLM.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/3540-7-0x0000000000680000-0x0000000000681000-memory.dmp

memory/4404-13-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3540-14-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/3540-17-0x0000000000680000-0x0000000000681000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231023-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

N/A

Files

memory/808-0-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

memory/808-1-0x0000000000A30000-0x0000000000AB0000-memory.dmp

memory/808-2-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

memory/808-3-0x0000000000A30000-0x0000000000AB0000-memory.dmp

memory/808-4-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

memory/808-5-0x0000000000A30000-0x0000000000AB0000-memory.dmp

memory/808-6-0x0000000000A30000-0x0000000000AB0000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231201-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:42

Platform

win7-20231023-en

Max time kernel

25s

Max time network

31s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1928 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1928 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 1928 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 1928 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 1928 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 1928 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 1928 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/1928-0-0x00000000011E0000-0x0000000001C7C000-memory.dmp

memory/1928-1-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

memory/1928-2-0x000000001BA20000-0x000000001CA36000-memory.dmp

memory/1928-3-0x00000000003E0000-0x00000000003E6000-memory.dmp

memory/1928-4-0x000000001B1E0000-0x000000001B260000-memory.dmp

memory/1928-5-0x000000001B1E0000-0x000000001B260000-memory.dmp

memory/1928-6-0x000000001B1E0000-0x000000001B260000-memory.dmp

memory/1928-13-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

memory/2440-15-0x0000000002B80000-0x0000000002B81000-memory.dmp

memory/1928-16-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

memory/904-17-0x00000000026E0000-0x00000000026E1000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231130-en

Max time kernel

140s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

N/A

Files

memory/1112-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1112-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1112-3-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1112-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1112-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:42

Platform

win7-20231020-en

Max time kernel

9s

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1968 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2160 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2160 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2160 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2160 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2160 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2160 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/1968-0-0x0000000074320000-0x0000000074A0E000-memory.dmp

memory/1968-1-0x0000000000FA0000-0x000000000164E000-memory.dmp

memory/1968-2-0x00000000007E0000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/1968-15-0x00000000007E0000-0x0000000000820000-memory.dmp

memory/1968-16-0x0000000000A80000-0x0000000000A8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/1968-25-0x000000006B440000-0x000000006B752000-memory.dmp

memory/1968-29-0x0000000000D40000-0x0000000000D4A000-memory.dmp

memory/1968-30-0x0000000000D40000-0x0000000000D4A000-memory.dmp

memory/1968-28-0x0000000000D40000-0x0000000000D4A000-memory.dmp

memory/1968-27-0x0000000000D40000-0x0000000000D4A000-memory.dmp

memory/1968-26-0x0000000000D40000-0x0000000000D4A000-memory.dmp

memory/1968-32-0x0000000000F90000-0x0000000000F9A000-memory.dmp

memory/1968-33-0x0000000000F90000-0x0000000000F9A000-memory.dmp

memory/1968-31-0x0000000000E00000-0x0000000000E0A000-memory.dmp

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/1968-97-0x0000000000D20000-0x0000000000D21000-memory.dmp

memory/1968-96-0x0000000074320000-0x0000000074A0E000-memory.dmp

memory/1968-841-0x00000000007E0000-0x0000000000820000-memory.dmp

memory/2144-842-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/1968-843-0x0000000000F90000-0x0000000000F95000-memory.dmp

memory/1968-844-0x000000006B440000-0x000000006B752000-memory.dmp

memory/1968-845-0x0000000000E00000-0x0000000000E0A000-memory.dmp

memory/1968-846-0x0000000074320000-0x0000000074A0E000-memory.dmp

memory/3048-847-0x00000000026E0000-0x00000000026E1000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231127-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDD6F6.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDD70C.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2256 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2256 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2256 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2060 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 476 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 476 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 476 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2060 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2912 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 4464 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4464 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4464 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 30401701762118.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/2060-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\u.wry

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\30401701762118.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 4bb5f3129b6bfc6eac22a3330fb81606
SHA1 89cbcf709eb320eb8e780f678ab8aebecf2f9d43
SHA256 3e47f8c8b86b78b48fb4ca91cf566af3fbcc186bf1488c97c545428550f30fa3
SHA512 24f8df624f08a1b299716465e4ef55c3d581cf1331ce1a702d82e4a7c3ef391348d90d361fbf5d96a42d84bc4acc76802538d85fc50bb3f7b15a787d3286e21c

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 55338b87e6f136a3f919ee22a41b0cca
SHA1 063c69a68500363a92cea2ea4f571e0be1a6363c
SHA256 88353a0a5a49662411e830b83571bbde7445ee5327f82d62d0c785539aa282a7
SHA512 6de03038d94a5c50c61fd85e9cc98cd6b396da0fdbd1d15fd8b510e6dbdb99a0e982d7a2ad2b4ac376780fc74d6731b9727dc661f2a90a3279bf7aa76653ebed

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 4e7db818d6619108501855b9163c8f4d
SHA1 9e65c5f32f8658ca0e82d0e0477d896d4684eb2a
SHA256 b28a030b02518f23ad32ef38d7e1e42065aa04918584f2f86e5cb98cafd12f9a
SHA512 06acd23d7b92b197a15ecb1dd2ceec6b293029a5d1ca687b5d06b989f99eece5cbadab207ae93f41d0982fd44b09a9daf03433d82138f4cfe60725ce30f3a759

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

MD5 4bb5f3129b6bfc6eac22a3330fb81606
SHA1 89cbcf709eb320eb8e780f678ab8aebecf2f9d43
SHA256 3e47f8c8b86b78b48fb4ca91cf566af3fbcc186bf1488c97c545428550f30fa3
SHA512 24f8df624f08a1b299716465e4ef55c3d581cf1331ce1a702d82e4a7c3ef391348d90d361fbf5d96a42d84bc4acc76802538d85fc50bb3f7b15a787d3286e21c

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 41f461ab2f61bbf5b01e97df93855ea4
SHA1 1047b5b50a6aba6e2a70c745faccca77a43a09b9
SHA256 a2c5bd0e1538c280479bf70fe475af3f61fb64ca682e81290c6b0c4ccaa32327
SHA512 5e4f884fef5d3bc4540ef2ed35aad4efaed16195e86dd880baa935441800866543eac2b66fc2832c11be63ede768f1688bee2fcdbbd566205d5917b596502ca0

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 4e7db818d6619108501855b9163c8f4d
SHA1 9e65c5f32f8658ca0e82d0e0477d896d4684eb2a
SHA256 b28a030b02518f23ad32ef38d7e1e42065aa04918584f2f86e5cb98cafd12f9a
SHA512 06acd23d7b92b197a15ecb1dd2ceec6b293029a5d1ca687b5d06b989f99eece5cbadab207ae93f41d0982fd44b09a9daf03433d82138f4cfe60725ce30f3a759

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 bd1ad44a736553572768febca7a629f0
SHA1 7c222a7e12d387c08886caef03a1dc5c5203842e
SHA256 621ec5df4b6268abd9b467cea0f1bb5224322fbeb43f38e1d4556c48eea96ab9
SHA512 6ff8bf45a020053f5d4528fd5e29ff7ed5d21d76834f73d34575f47ea6f0732a2375f8083a35f6dfc37266fac60c87f416ccb37ee817056fb50396eff28e926e

Analysis: behavioral15

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231201-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

N/A

Files

memory/1240-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1240-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/1240-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231130-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

Files

memory/4520-0-0x00000000005D0000-0x00000000005D1000-memory.dmp

memory/4520-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/4520-3-0x00000000005D0000-0x00000000005D1000-memory.dmp

memory/4520-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231130-en

Max time kernel

142s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231127-en

Max time kernel

147s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

memory/3328-0-0x0000000002390000-0x0000000002391000-memory.dmp

memory/3328-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/3328-3-0x0000000002390000-0x0000000002391000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:42

Platform

win7-20231023-en

Max time kernel

7s

Max time network

10s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2136-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/2136-10-0x0000000000220000-0x0000000000244000-memory.dmp

memory/2136-9-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/2556-13-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/2636-14-0x00000000026D0000-0x00000000026D1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231201-en

Max time kernel

142s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/5072-0-0x0000000002310000-0x0000000002311000-memory.dmp

memory/5072-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-2-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-3-0x0000000002310000-0x0000000002311000-memory.dmp

memory/5072-4-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-5-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-7-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-9-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-10-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-11-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-12-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-13-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-14-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5072-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231130-en

Max time kernel

101s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-423100829-2271632622-1028104103-1000\{01414988-B166-4BEB-84FA-C39A057604A1} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4a4 0x3ec

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp

Files

memory/1468-0-0x0000000000050000-0x00000000004B4000-memory.dmp

memory/1468-1-0x00007FF9C0220000-0x00007FF9C0CE1000-memory.dmp

memory/1468-2-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-3-0x000000001C800000-0x000000001C810000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/1468-14-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-16-0x000000001CFC0000-0x000000001CFC8000-memory.dmp

memory/1468-18-0x000000001D790000-0x000000001D7C8000-memory.dmp

memory/1468-19-0x000000001D760000-0x000000001D76E000-memory.dmp

memory/1468-17-0x000000001C800000-0x000000001C810000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 97a7ef9c9082acada19fa9a051f62ca6
SHA1 e830a2bb4cd7718e72fc100c36c0c8fe10fcb4ed
SHA256 53b8e65bdc35110d7b911b1d333925effc13c70498f58cbf5b6b0c575fb2a357
SHA512 5f10e4c20d377ebbdcdbe528b33121f0ff955476108f4679a468453fb85fe419db6a28e0a4afef201c5e52553ede70045c6de661b127e9784b44baec0db7dbf3

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/1468-37-0x00007FF9C0220000-0x00007FF9C0CE1000-memory.dmp

memory/1468-38-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-39-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-40-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-41-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-42-0x000000001C800000-0x000000001C810000-memory.dmp

memory/1468-56-0x00007FF9C0220000-0x00007FF9C0CE1000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win10v2004-20231127-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 107.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 49.192.11.51.in-addr.arpa udp

Files

memory/2068-0-0x00007FFF530E0000-0x00007FFF53A81000-memory.dmp

memory/2068-1-0x0000000000D40000-0x0000000000D50000-memory.dmp

memory/2068-2-0x000000001B430000-0x000000001B4D6000-memory.dmp

memory/2068-3-0x00007FFF530E0000-0x00007FFF53A81000-memory.dmp

memory/2068-4-0x000000001BAB0000-0x000000001BF7E000-memory.dmp

memory/2068-5-0x000000001C020000-0x000000001C0BC000-memory.dmp

memory/2068-6-0x000000001B510000-0x000000001B518000-memory.dmp

memory/2068-7-0x000000001C180000-0x000000001C1CC000-memory.dmp

memory/2068-8-0x0000000000D40000-0x0000000000D50000-memory.dmp

memory/2068-9-0x00007FFF530E0000-0x00007FFF53A81000-memory.dmp

memory/2068-10-0x0000000000D40000-0x0000000000D50000-memory.dmp

memory/2068-11-0x00007FFF530E0000-0x00007FFF53A81000-memory.dmp

memory/2068-12-0x0000000000D40000-0x0000000000D50000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231129-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp
PID 2164 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp" /SL5="$400E2,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

N/A

Files

memory/2164-0-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/2916-8-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-HOD9K.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/2164-2-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-G0L97.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-G0L97.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2164-16-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2916-17-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2916-20-0x0000000000240000-0x0000000000241000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-05 07:41

Reported

2023-12-05 07:44

Platform

win7-20231023-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Network

N/A

Files

memory/1336-0-0x0000000001080000-0x00000000014E4000-memory.dmp

memory/1336-1-0x000007FEF5650000-0x000007FEF603C000-memory.dmp

memory/1336-2-0x000000001B820000-0x000000001B8A0000-memory.dmp

memory/1336-3-0x000000001B820000-0x000000001B8A0000-memory.dmp

memory/1336-4-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

memory/1336-5-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/1336-13-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-15-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-16-0x0000000001060000-0x000000000106A000-memory.dmp

memory/1336-17-0x0000000001060000-0x000000000106A000-memory.dmp

memory/1336-14-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-12-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-11-0x000007FEEB380000-0x000007FEEB771000-memory.dmp

memory/1336-18-0x000007FEEF4B0000-0x000007FEEF5F3000-memory.dmp

memory/1336-20-0x0000000001060000-0x000000000106A000-memory.dmp

memory/1336-19-0x000007FEC4440000-0x000007FEC444A000-memory.dmp

memory/1336-21-0x0000000001010000-0x0000000001011000-memory.dmp

memory/1336-23-0x000007FEF5650000-0x000007FEF603C000-memory.dmp

memory/1336-24-0x000000001B820000-0x000000001B8A0000-memory.dmp

memory/1336-25-0x000000001B820000-0x000000001B8A0000-memory.dmp

memory/1336-26-0x000007FEEB380000-0x000007FEEB771000-memory.dmp

memory/1336-28-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

memory/1336-29-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-31-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-32-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-33-0x0000000001060000-0x000000000106A000-memory.dmp

memory/1336-30-0x0000000001020000-0x000000000102A000-memory.dmp

memory/1336-34-0x0000000001060000-0x000000000106A000-memory.dmp

memory/1336-35-0x000007FEEF4B0000-0x000007FEEF5F3000-memory.dmp

memory/1336-36-0x000007FEC4440000-0x000007FEC444A000-memory.dmp

memory/1336-37-0x0000000001060000-0x000000000106A000-memory.dmp

memory/1336-41-0x000007FEF5650000-0x000007FEF603C000-memory.dmp

memory/1336-42-0x000007FEEB380000-0x000007FEEB771000-memory.dmp

memory/1336-43-0x000007FEEF4B0000-0x000007FEEF5F3000-memory.dmp