Malware Analysis Report

2024-08-06 15:31

Sample ID 231205-kt32taae27
Target 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
SHA256 1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
Tags
aspackv2 chaos bootkit persistence evasion ransomware spyware stealer wannacry worm trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518

Threat Level: Known bad

The file 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip was found to be: Known bad.

Malicious Activity Summary

aspackv2 chaos bootkit persistence evasion ransomware spyware stealer wannacry worm trojan

Chaos

Modifies Windows Defender Real-time Protection settings

Chaos family

Wannacry

Chaos Ransomware

UAC bypass

Deletes shadow copies

Modifies boot configuration data using bcdedit

Sets file execution options in registry

Disables Task Manager via registry modification

Disables use of System Restore points

Disables RegEdit via registry modification

Modifies Windows Firewall

Reads user/profile data of web browsers

ASPack v2.12-2.42

Drops startup file

Deletes itself

Executes dropped EXE

Checks whether UAC is enabled

Enumerates connected drives

Modifies WinLogon

Adds Run key to start application

Drops desktop.ini file(s)

Writes to the Master Boot Record (MBR)

Sets desktop wallpaper using registry

Drops autorun.inf file

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy service COM API

Kills process with taskkill

Suspicious use of FindShellTrayWindow

Opens file in notepad (likely ransom note)

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

System policy modification

Interacts with shadow copies

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Pre-OS Boot
T1542
Bootkit
T1542.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Pre-OS Boot
T1542
Bootkit
T1542.003
Modify Registry
T1112
Indicator Removal
T1070
File Deletion
T1070.004
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Defacement
T1491
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-12-05 08:54

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral9

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 08:55

Platform

win11-20231128-en

Max time kernel

4s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "167" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4456 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4456 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4456 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3a0a055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 195.201.50.20.in-addr.arpa udp

Files

memory/4456-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/4456-5-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

Analysis: behavioral5

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1766s

Max time network

1727s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-89531631-1347641568-3714596404-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8yvin07ql.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 804 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 804 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 4080 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4080 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3728 wrote to memory of 2604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3728 wrote to memory of 2604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3728 wrote to memory of 3508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3728 wrote to memory of 3508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4080 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 4080 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

Files

memory/804-0-0x0000000000C40000-0x0000000000C50000-memory.dmp

memory/804-1-0x00007FFC40150000-0x00007FFC40C12000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/804-14-0x00007FFC40150000-0x00007FFC40C12000-memory.dmp

memory/4080-15-0x00007FFC40150000-0x00007FFC40C12000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/4080-484-0x00007FFC40150000-0x00007FFC40C12000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1792s

Max time network

1699s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

Files

memory/3800-0-0x0000000002460000-0x0000000002461000-memory.dmp

memory/3800-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/3800-3-0x0000000002460000-0x0000000002461000-memory.dmp

memory/3800-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1789s

Max time network

1741s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231128-en

Max time kernel

1799s

Max time network

1451s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9E59.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9E6F.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3268 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3268 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3268 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1600 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1600 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 3268 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 3268 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3268 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3268 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2840 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2840 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 5932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 5932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3268 wrote to memory of 5932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3624 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 3624 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 3624 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 5068 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 5068 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 298981701766507.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3268-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\u.wry

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\298981701766507.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 1a08c4246be5baef9387ea72d2405f06
SHA1 b5e8a4630e6fa9dbab8561677d91bade91d25e58
SHA256 a0d949cd0db3098f01a1ca2eb74870e4113a05913477bae62727bcc3f1fe9f90
SHA512 18996a955d41fa14caf180d1a5a222877e0797bdfbfd62ed0c0d3bdbfeb707ff9f918be8e06edf632c95f01f3d8fcc8fdf16a70983e61741b14c33f8a99ac968

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 856d7d53b6e5c56ec88dde69791b09ee
SHA1 b27586ae72cf7306cec56b20731d94e085a7dce6
SHA256 1387ade288596e374b779d14994481720c1d496df03dc47c327e705b7f3908dc
SHA512 962d92350bdf18574db65c75334321c3f1942af21591dd873cf32b92f91c7c6d1d72f899fb9b652163f9af7c0047180acbbb6bd222b41276774c2b43de7989e1

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 48c3f29472f40a52116b5b8019286626
SHA1 197286cd6cc77e73aab596fb80a4a3fdf09364ad
SHA256 b1c1d66b97b4f406affafe90659101db4c1d3fb158f7074e33d152fcf571c61f
SHA512 25b6edb257192dfeb231b4df2dbb0431246f144754e6f6d988e4acf337d40dbc0507eadf48b86730345fd522285e1b6a879f58581912e0b039d61d8d9273ed0a

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

MD5 1a08c4246be5baef9387ea72d2405f06
SHA1 b5e8a4630e6fa9dbab8561677d91bade91d25e58
SHA256 a0d949cd0db3098f01a1ca2eb74870e4113a05913477bae62727bcc3f1fe9f90
SHA512 18996a955d41fa14caf180d1a5a222877e0797bdfbfd62ed0c0d3bdbfeb707ff9f918be8e06edf632c95f01f3d8fcc8fdf16a70983e61741b14c33f8a99ac968

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 856d7d53b6e5c56ec88dde69791b09ee
SHA1 b27586ae72cf7306cec56b20731d94e085a7dce6
SHA256 1387ade288596e374b779d14994481720c1d496df03dc47c327e705b7f3908dc
SHA512 962d92350bdf18574db65c75334321c3f1942af21591dd873cf32b92f91c7c6d1d72f899fb9b652163f9af7c0047180acbbb6bd222b41276774c2b43de7989e1

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 ae6d8bdaace787134d7ec4912979e204
SHA1 0d1cee68f839099519863a5f5f68bff6004ac1ef
SHA256 0b895579e9c0781c0ff1d811f68fc64626b6a0599223fee0cdc08b0b128367da
SHA512 6673ab2d822985327f5e392b888ee089baf608f70dc86a0300db883d92bbf0edc636f7012d50087d0578ce08a71a6b420671d9d765295b47ce205d8b4c585e23

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 39335c6a566c9d5c3f366c3b7b634383
SHA1 619fd8ab31e1c9be81213210579a38c3642720ee
SHA256 b215492291eb7d72afbb1286d6dfc65de9eb613bdbfb24e8ff0bc3fb24a0fc16
SHA512 d06cbc4939e27e668fada3788784d90a1946556268424cde0424dac3539c2e67d018231e0598a35166bbb4d92e7fc07473dc3ae983958b03adf2509dcf868193

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 08:55

Platform

win11-20231129-en

Max time kernel

4s

Max time network

11s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2379530898-3444504291-4008811794-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2379530898-3444504291-4008811794-1000\{B53187DD-35F7-49B2-BE5C-468D0287E939} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3752 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 980 wrote to memory of 3936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 980 wrote to memory of 3936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 980 wrote to memory of 3936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 980 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 980 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 980 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 980 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 980 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 980 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 980 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 980 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 980 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3a08055 /state1:0x41c64e6d

Network

Files

memory/3752-1-0x0000000000FA0000-0x000000000164E000-memory.dmp

memory/3752-0-0x0000000074C80000-0x0000000075431000-memory.dmp

memory/3752-2-0x0000000006190000-0x00000000061A0000-memory.dmp

memory/3752-3-0x00000000067C0000-0x0000000006D66000-memory.dmp

memory/3752-10-0x0000000006190000-0x00000000061A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3752-22-0x0000000009F80000-0x0000000009FB8000-memory.dmp

memory/3752-23-0x0000000009F50000-0x0000000009F5E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/3752-29-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-30-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-34-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-32-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-31-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-35-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-36-0x000000000C510000-0x000000000C520000-memory.dmp

memory/3752-37-0x000000000C510000-0x000000000C520000-memory.dmp

memory/3752-38-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-40-0x000000000C510000-0x000000000C520000-memory.dmp

memory/3752-41-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-42-0x000000000C510000-0x000000000C520000-memory.dmp

memory/3752-39-0x000000000A130000-0x000000000A140000-memory.dmp

memory/3752-43-0x000000000C510000-0x000000000C520000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 32141b4b264c09f562dc42bb8c9f1c8a
SHA1 7abca1b56e87ac62d4f173713b53495d7b5c7282
SHA256 bb3dcd5b2665950f8a02892f78565054f59a6574e8dfa0f15950b4103d5984c1
SHA512 62d7f61be009dd0f1fbd996e15ee34e5a40e15bd7b14da54bc7fed0bdb9a6fe8509ddee15ff7cee0504a30eef451cba0ecab18b8a3cecc9c727dcbbb3ba49186

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/3752-862-0x0000000074C80000-0x0000000075431000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1795s

Max time network

1799s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

Files

memory/4732-0-0x0000000002420000-0x0000000002421000-memory.dmp

memory/4732-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-2-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-3-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-4-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-5-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-7-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-9-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-10-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-11-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-12-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-13-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-14-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-15-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-16-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-17-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-18-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-19-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-20-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-21-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-22-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-23-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-24-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-25-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-26-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-27-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-28-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-29-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-30-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-31-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-32-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-33-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-34-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-35-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-36-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-37-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-38-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-39-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-40-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-41-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-42-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-43-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-44-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-45-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-46-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-47-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-48-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-49-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-50-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-51-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-52-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-53-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-54-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-55-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-56-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-57-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-58-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-59-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-60-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-61-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-62-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-63-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4732-64-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231128-en

Max time kernel

1792s

Max time network

1495s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3532-0-0x0000000002370000-0x0000000002371000-memory.dmp

memory/3532-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/3532-3-0x0000000002370000-0x0000000002371000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 08:55

Platform

win11-20231128-en

Max time kernel

25s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1442720915-2608432821-4011209344-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1442720915-2608432821-4011209344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1442720915-2608432821-4011209344-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "106" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4256 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4256 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4256 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4256 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4256 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4256 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4256 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 4256 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 4256 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 4256 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3a0d855 /state1:0x41c64e6d

Network

Files

memory/4256-1-0x00007FFB24A20000-0x00007FFB254E2000-memory.dmp

memory/4256-0-0x000001231CF50000-0x000001231D9EC000-memory.dmp

memory/4256-2-0x0000012338080000-0x0000012339096000-memory.dmp

memory/4256-3-0x000001231DDF0000-0x000001231DDF6000-memory.dmp

memory/4256-4-0x0000012338070000-0x0000012338080000-memory.dmp

memory/4256-5-0x0000012338070000-0x0000012338080000-memory.dmp

memory/4256-6-0x0000012338070000-0x0000012338080000-memory.dmp

memory/4256-13-0x00007FFB24A20000-0x00007FFB254E2000-memory.dmp

memory/4256-15-0x00007FFB24A20000-0x00007FFB254E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1697s

Max time network

1629s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3297911616-2937201660-2816093920-1000\{9243B740-3C1D-4020-AAB4-46C3B3838AEE} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004C4

Network

Files

memory/3156-0-0x0000000000940000-0x0000000000DA4000-memory.dmp

memory/3156-1-0x00007FFF679D0000-0x00007FFF68492000-memory.dmp

memory/3156-2-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3156-13-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

memory/3156-15-0x000000001C230000-0x000000001C238000-memory.dmp

memory/3156-16-0x000000001F100000-0x000000001F138000-memory.dmp

memory/3156-17-0x000000001C8B0000-0x000000001C8BE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 9094c783418a02287a50e36fa6c8a56d
SHA1 668133014fe33c9e8116f99e7398a9882f3742bb
SHA256 5fb3c0c9cce8a7576c7fb22424d9e702dab7d81d4aba2e8098264f4092a358c3
SHA512 00b947b28b1988897729dc6c37b094441a489d33a02ff961d6934e8d5755894cf094e66ce76400c46bd035bda867516a5d5404b3ce05b6120efec3f0c981d1a6

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/3156-35-0x00007FFF679D0000-0x00007FFF68492000-memory.dmp

memory/3156-36-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

memory/3156-37-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

memory/3156-38-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

memory/3156-52-0x00007FFF679D0000-0x00007FFF68492000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1738s

Max time network

1686s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4600 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe C:\Windows\system32\fondue.exe
PID 4600 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe C:\Windows\system32\fondue.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

C:\Windows\system32\fondue.exe

"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll

Network

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2023-12-05 08:54

Reported

2023-12-05 09:25

Platform

win11-20231129-en

Max time kernel

1792s

Max time network

1652s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3756 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp
PID 3756 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp
PID 3756 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp" /SL5="$50204,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

Files

memory/3756-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3756-2-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/4756-7-0x0000000002440000-0x0000000002441000-memory.dmp

memory/3756-13-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4756-14-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/4756-17-0x0000000002440000-0x0000000002441000-memory.dmp