Malware Analysis Report

2025-08-11 01:35

Sample ID 231207-ze118sgg6s
Target 60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d
SHA256 60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d
Tags
upx vmprotect
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d

Threat Level: Likely malicious

The file 60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d was found to be: Likely malicious.

Malicious Activity Summary

upx vmprotect

Drops file in Drivers directory

VMProtect packed file

Checks computer location settings

Unexpected DNS network traffic destination

Deletes itself

UPX packed file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Checks SCSI registry key(s)

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-07 20:38

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-07 20:38

Reported

2023-12-07 20:41

Platform

win7-20231023-en

Max time kernel

150s

Max time network

123s

Command Line

winlogon.exe

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\jTGjvkpR7NIJ.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\EinIcd39NGKP.fei C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\G7SvHxKeRkwrGx.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\pnwsYs3Mjw.xyl C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\66W049y86AyFT.qyc C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\JxEJ1MFGeW7jY.sys C:\Windows\Explorer.EXE N/A
File created C:\Windows\System32\drivers\Y3h6VbmiB.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\ZS6HckOls7du.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\QlkIxz9aU0aXcP.nts C:\Windows\Explorer.EXE N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 223.5.5.5 N/A N/A
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\ZiHXM8q1OtUSy.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\rqK1rXw7GGmz.fld C:\Windows\Explorer.EXE N/A
File created C:\Windows\system32\ \Windows\System32\YBbNWIKG.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\gYuxViXFgTHS6.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\tFl1NX1TuDO37.abj C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\Q0vifwawxPbPR.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\cqRh35R3dMuKfJ.bjp C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\I6v1gGCO9w.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\IxvqxYlHHBg7.tke C:\Windows\Explorer.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\MwY6xopJPSIcXD.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Java\4d566cea.html C:\Windows\system32\Dwm.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\3ddeb4c0.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Mail\3ddf0474.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\oTKDWWYx9guHwx.efm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\PFIIz81WiX.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\CF3csv6XzGpc.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\RAHGP2XFHzVf5.pnr C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\L0XyunRRKWkIp2.vwm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Java\manifest.json C:\Windows\system32\Dwm.exe N/A
File opened for modification C:\Program Files\VJNZYBQskirdQS.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\27cmkjzRc1.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Java\5cce1c4c.js C:\Windows\system32\Dwm.exe N/A
File opened for modification C:\Program Files\Windows Mail\lib\6c4647cb.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Mozilla Firefox\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Mozilla Firefox\5cce0f20.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Java\lib\6c45cbae.js C:\Windows\system32\Dwm.exe N/A
File opened for modification C:\Program Files\Windows Mail\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Mail\5cce86ae.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Mail\4d56c591.html C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\SSeQZcbOLn8UB7.met C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\DYYTgeQpI4C.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\UmauX1y0NCIRuv.yzu C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\ZxM3EehP4Ek.tjl C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\SNOxgAolMpvM5.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Mozilla Firefox\4d5661f0.html C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\rNK9q5ch2v.jla C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\DBPNIYaRdXJ.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\403jEmMuSPqsOE.dcm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Mozilla Firefox\lib\6c45bc50.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Java\3ddebd88.js C:\Windows\system32\Dwm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\P48itg9tAlE3G.kkh C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\CYZQBdeHFWjt8D.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\pQ53Ks5LKS.trb C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\wAArsC3ifQTL.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\fXoAzxgmuSOV.ilv C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\err_2852.log C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
File created C:\Windows\J6bkpt.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\jhPE7GwG61.fdd C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\RO5Akibtm0T4H.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\Ai0Itwvn5j6TU.sys C:\Windows\Explorer.EXE N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\system32\Dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\Dwm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\Dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2852 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2852 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2852 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2852 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2852 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2852 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2852 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2852 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2852 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2852 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2344 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2344 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2344 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe
PID 1232 wrote to memory of 1160 N/A C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe

"C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 de108ad81976e232.vbnm34567.xyz udp
US 114.114.114.114:53 down.magiforet.cn udp
CN 122.189.171.115:443 down.magiforet.cn tcp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 114.114.114.114:53 down.zhangyaping.top udp
CN 223.5.5.5:53 dns.alidns.com udp
US 8.8.8.8:53 down.zhangyaping.top udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 yzzcommon.tyui54345.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 36.248.54.85:443 down.nugong.asia tcp
US 8.8.8.8:53 down.nugong.asia udp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.27:443 apps.game.qq.com tcp
CN 36.248.54.85:443 down.nugong.asia tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
CN 36.143.236.7:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 sp1.baidu.com udp
US 104.193.88.77:443 sp1.baidu.com tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
N/A 234.2.2.2:27878 udp
N/A 233.123.112.211:17181 udp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
US 8.8.8.8:53 down.yunianhui.club udp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
US 8.8.8.8:53 nreprot.nugong.asia udp
CN 42.231.136.87:443 nreprot.nugong.asia tcp
US 8.8.8.8:53 b2rpt.hjkl45678.xyz udp
US 8.8.8.8:53 mprrpt.nugong.asia udp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 42.192.71.187:8088 b2rpt.hjkl45678.xyz tcp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 218.29.50.234:443 mprrpt.nugong.asia tcp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp

Files

memory/2852-0-0x0000000000350000-0x00000000003DF000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarA6D1.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

memory/2852-71-0x0000000000350000-0x00000000003DF000-memory.dmp

memory/1232-641-0x0000000002790000-0x0000000002793000-memory.dmp

memory/1232-643-0x0000000002790000-0x0000000002793000-memory.dmp

memory/1232-646-0x0000000004EC0000-0x0000000004F71000-memory.dmp

memory/1232-645-0x0000000002790000-0x0000000002793000-memory.dmp

memory/1232-648-0x0000000004EC0000-0x0000000004F71000-memory.dmp

memory/1232-647-0x000007FEBE1B0000-0x000007FEBE1C0000-memory.dmp

memory/420-651-0x00000000008F0000-0x0000000000918000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dbccdcc9c1eb9d0cb0ffd527684f0b7a
SHA1 613bbcd163182a614845bfe3fcef6a1bc643c862
SHA256 bb15336f806aebd87db85734d81a85684d35a01cfbb704206099dcca2fde2da7
SHA512 bedc030bad4b1e2a006457b82826b9b8c38cdf1653f6f127cd102792361bc7c90de93ef4aa2866527cff84471ce71dff396a8ae91be076e076d51eccf6dd4f68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1d75c7d7c0610e4757d8584fb705780
SHA1 595fff22bba4ec4daaf9ac2e48ea5c71a5a709d3
SHA256 e83c5d5be485c93b6991359d722745f24d8466b3da197835c964ff6a1610966b
SHA512 d3b7ccb7b88f7498b94961f79e401135bc9e60453f15be517794f834243d9e08ce61fd1ab6c8fc8dd659735aa3a17a983244a7db1d488107605cb279c895bbf4

memory/1232-702-0x0000000037B00000-0x0000000037B10000-memory.dmp

memory/1232-704-0x00000000008F0000-0x0000000000918000-memory.dmp

memory/2852-705-0x0000000000350000-0x00000000003DF000-memory.dmp

memory/1232-706-0x00000000008F0000-0x0000000000918000-memory.dmp

memory/1232-707-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/1232-709-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/1232-708-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/1232-710-0x0000000004EC0000-0x0000000004F71000-memory.dmp

memory/1232-711-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/1232-712-0x00000000008F0000-0x0000000000918000-memory.dmp

memory/1232-713-0x0000000009390000-0x000000000943F000-memory.dmp

memory/1232-715-0x0000000009390000-0x000000000943F000-memory.dmp

C:\Windows\RO5Akibtm0T4H.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

C:\Windows\Ai0Itwvn5j6TU.sys

MD5 f696aab1d8af39b5bda5edc6b7cc12d6
SHA1 6cc11c321728608e7c3b202a9d53c39f33d6e8d7
SHA256 0520e04d912fe979e0382e7285dd919bc0e3e0606a3c398c64e0b799f1613321
SHA512 9ba2564216e025eba689b46e88ce1322fb6cccac2eba68a9a630ee0b8002c05921a953d67cc1709efb4d9c85361b5a80a56d79fda065b709e67812e704b9f706

C:\Windows\CYZQBdeHFWjt8D.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Windows\wAArsC3ifQTL.sys

MD5 6a091df465562a3766d0fe5635bc3937
SHA1 ea517d7963ea9208de48ed90187c044a6f2869d3
SHA256 bd53820f8615692b08b22cb40644f57336abee92a25b3f075bae19fb3879e4f5
SHA512 f2d2a890d559c2562a22074dfed7f25fc11e96df8de7238609aea87d50ed1f352852cde38b14954c104e0f0d7746980c7b01f0479e1fad67b1ceccfc732968c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 e722777424420d7db5a2e0b0dd481921
SHA1 0ae284a19cbf46182c84b0408ab71f423a73c991
SHA256 5bc303c1b965aca9f59b5e8cd988ccc7ae36fc02cc93bc6eb7b2a0d213d05e9c
SHA512 0d312f65663ef52caf83b9b80725bbd609e183bac7d177457bc7b3df49d9f71a5f2a849d8ce98f7f6b2c17aa70c570ec4eadb19951b3cca0fb01c71b60cd926a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 b3e886f0a26b67c1234b30c755341758
SHA1 8a881fb559672e95834def740fc5ba017879b0db
SHA256 808b71ea8048ef6e5014fbd1dedbd496516bf963107c8dff13a53d807c60686f
SHA512 66f612ae244a65d623617290f58bd01b8db16fcb98d9b60dca78adc7b2371bfff0ad03dbb244def434e8f243efcef37337a39a30871c64dcd1f6db6e57f50524

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 9ba47a279b7950e198b6076171704bd8
SHA1 2d40167fb1cffc590d18f00b6ae5a22a7ba2bcab
SHA256 1d855e013b588989a67757730de9fef0ae45fba49359eeeb9ca7ce03089f75c6
SHA512 d048eb90cc64e568aa36c857a19ab9d4ebbb829716ec397d91fe92ab7cf0e5addbb2928cabfdec043ed46db02b2705a079668184474c08f5e7e57d58122d83c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 d3a51fc08a8ebd6e79978edac007d197
SHA1 3a61b400ab126ac21c24a96a3f21207ccf46aa6e
SHA256 315cbb16bba3dfc1a3264746fd366132af75c33aa376c63d480a1cc4895661a9
SHA512 263d57f4e80332af94bf1aab478fac6a9692f1849b9549050f9ff3f2d0887f63dc4d72b8604dc0654e875ea0460d49c8a5038be5d033d1bf82a0a926e6f4fd7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 3fefedd2d651734aab0aff2f8161db56
SHA1 eda0d013d0db080e6477965234bf4db2aceb215e
SHA256 4a2a561a396876d9ef6387f7f5394313a82d06945aae92d672a39b3db8cc5f01
SHA512 0ac825bf61b063f64e93eb4638ebeb63457309068e8a8ac27ea15b79c0ae7968ec1db6df757d74d9350abfd262d2a834ab54ee47f8d04dbb6451f7133072a56e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 ad6eee3bc40a4d01931d53dd3050f1ed
SHA1 31618360c73df64b19ed2ad0d6e12488fcb3a460
SHA256 f9397156fa4e1e02ef0724e2ef970600f62f69ce7a390bfaa38c773f43a26d5c
SHA512 0e25c56861bda0618cffe9329f031a54966d5759fd05df95af1ef44d33ee2d1bb63785ed664fe7f016abe2e30c8aae8a776dffdae308432785ba2481c7bf3b19

memory/1232-833-0x0000000009390000-0x000000000943F000-memory.dmp

memory/1232-834-0x00000000008F0000-0x0000000000918000-memory.dmp

memory/1160-835-0x0000000001F20000-0x0000000001FCA000-memory.dmp

memory/1232-836-0x0000000009390000-0x000000000943F000-memory.dmp

memory/1232-837-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/1160-839-0x0000000001B40000-0x0000000001B41000-memory.dmp

memory/1160-842-0x0000000001C60000-0x0000000001C63000-memory.dmp

memory/1160-846-0x0000000001C60000-0x0000000001C63000-memory.dmp

memory/1160-847-0x0000000001C60000-0x0000000001C63000-memory.dmp

memory/1160-848-0x0000000001FD0000-0x000000000207F000-memory.dmp

memory/1160-849-0x0000000001C80000-0x0000000001C81000-memory.dmp

memory/1160-850-0x0000000001C80000-0x0000000001C81000-memory.dmp

memory/1232-865-0x000000000ADF0000-0x000000000AE9F000-memory.dmp

memory/1232-869-0x000000000ADF0000-0x000000000AE9F000-memory.dmp

memory/1232-867-0x0000000009390000-0x000000000943F000-memory.dmp

memory/1160-882-0x00000000033C0000-0x000000000346F000-memory.dmp

memory/1232-883-0x0000000009390000-0x000000000943F000-memory.dmp

memory/1232-884-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

memory/1160-885-0x0000000001FD0000-0x000000000207F000-memory.dmp

memory/1232-886-0x000000000ADF0000-0x000000000AE9F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-07 20:38

Reported

2023-12-07 20:41

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

154s

Command Line

winlogon.exe

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\KLJyuwD0.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\FBkrKBIoYPe.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\Az7DuQt9Cg3Ca.rgm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\jXzwfYtlMqB.pst C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\p1TkKXdBF9.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\eozaedxRVi.hxk C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\8KmbJGGgwL1Ksm.ign C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\gpMBNmeeJO1.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\7vXCfnBP0aRh.sys C:\Windows\Explorer.EXE N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A
Destination IP 223.5.5.5 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\HFZrhhf1SKEQ.kac C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\Mw4bg3d52yY21d.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\fbAxxIYB7lPKpf.hlk C:\Windows\Explorer.EXE N/A
File created C:\Windows\system32\ \Windows\System32\nTE2rOl.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\tzfFEO9pva9.asm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\xSVBiS3G5cqxYw.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\jquEIUUNNTsQgG.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\sjNYwlsAK2.ywb C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\2xwmOxmotIBi4.sys C:\Windows\Explorer.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Google\3962a7dc.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\LeuOWYxIru.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\QasXFscW9zJ6Iq.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\ciEcPkE4Tp3nZW.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Tbg1jpLegdb.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\yBqh4srI2KF6v.bdo C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\44Aa9pgRj0.kxe C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Google\lib\646ca5c1.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\6aaoVQYhCnU.ant C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\Ebd0A3ieMTxY.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\NK1RJib5uqaY.yyo C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\E1eAaV7Y1GbnZT.hbj C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\3LL4Pa5p7SZWgA.zae C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\DXwguNxn40J.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\K2eAk14v1Yzqo1.tzp C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Google\5613fbca.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\pXh0eU8ZIv.yxn C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\gyilEaNQFX9LZt.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\98aX4UdycEY.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Google\47bb51d3.html C:\Windows\Explorer.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\err_2260.log C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
File created C:\Windows\G8VClw4BB.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\ME7MsVfOL74K4m.rqt C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\nP2H49EgmC.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\uoEuwKet5h90g.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\FkL8zGVWbqvsc.cpf C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\bQM8ehysQL.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\6qEHxOiQXYab.ysg C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\q3ITf5slosddh.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\C9VHS2lBpgP.fql C:\Windows\Explorer.EXE N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\Explorer.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\Explorer.EXE N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\Explorer.EXE N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\dwm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\Explorer.EXE
PID 2260 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2260 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2260 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2260 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2260 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\system32\winlogon.exe
PID 2260 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5008 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5008 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3104 wrote to memory of 336 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3104 wrote to memory of 336 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3104 wrote to memory of 336 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3104 wrote to memory of 336 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3104 wrote to memory of 336 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3104 wrote to memory of 336 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe

"C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\60fc4d533a0a52f0879a251180db730a996188f07618ea966d3607ea912de06d.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 de108ad81976e232.vbnm34567.xyz udp
US 114.114.114.114:53 down.magiforet.cn udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 114.114.114.114.in-addr.arpa udp
CN 122.189.171.115:443 down.magiforet.cn tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 106.243.43.23.in-addr.arpa udp
US 8.8.8.8:53 115.171.189.122.in-addr.arpa udp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 226.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 5.5.5.223.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 114.114.114.114:53 down.zhangyaping.top udp
CN 223.5.5.5:53 dns.alidns.com udp
US 8.8.8.8:53 down.zhangyaping.top udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 91.161.54.23.in-addr.arpa udp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 yzzcommon.tyui54345.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 42.231.136.87:443 down.nugong.asia tcp
US 8.8.8.8:53 down.nugong.asia udp
US 8.8.8.8:53 87.136.231.42.in-addr.arpa udp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
US 8.8.8.8:53 apps.game.qq.com udp
CN 42.231.136.87:443 down.nugong.asia tcp
US 8.8.8.8:53 85.54.248.36.in-addr.arpa udp
CN 101.227.134.27:443 apps.game.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
US 8.8.8.8:53 27.134.227.101.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 205.48.246.47.in-addr.arpa udp
CN 36.248.38.100:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 sp1.baidu.com udp
US 104.193.88.77:443 sp1.baidu.com tcp
US 8.8.8.8:53 100.38.248.36.in-addr.arpa udp
CN 36.248.54.85:80 down.nugong.asia tcp
US 8.8.8.8:53 77.88.193.104.in-addr.arpa udp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
N/A 234.2.2.2:27878 udp
N/A 233.123.112.211:17181 udp
US 8.8.8.8:53 2.2.2.234.in-addr.arpa udp
US 8.8.8.8:53 211.112.123.233.in-addr.arpa udp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
CN 36.248.54.85:80 down.nugong.asia tcp
US 8.8.8.8:53 nreprot.nugong.asia udp
CN 122.189.171.55:443 nreprot.nugong.asia tcp
US 8.8.8.8:53 b2rpt.hjkl45678.xyz udp
CN 36.248.54.85:80 nreprot.nugong.asia tcp
CN 42.192.71.187:8088 b2rpt.hjkl45678.xyz tcp
US 8.8.8.8:53 55.171.189.122.in-addr.arpa udp
CN 36.248.54.85:80 nreprot.nugong.asia tcp
US 8.8.8.8:53 mprrpt.nugong.asia udp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 42.231.136.215:443 mprrpt.nugong.asia tcp
US 8.8.8.8:53 187.71.192.42.in-addr.arpa udp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
CN 36.248.54.85:80 mprrpt.nugong.asia tcp
US 8.8.8.8:53 215.136.231.42.in-addr.arpa udp
US 8.8.8.8:53 34.249.72.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

memory/2260-0-0x0000000000430000-0x00000000004BF000-memory.dmp

memory/2260-15-0x0000000000430000-0x00000000004BF000-memory.dmp

memory/3104-21-0x00000000029A0000-0x00000000029A3000-memory.dmp

memory/3104-23-0x00000000029A0000-0x00000000029A3000-memory.dmp

memory/3104-24-0x0000000007520000-0x00000000075D1000-memory.dmp

memory/3104-26-0x00007FF905210000-0x00007FF905220000-memory.dmp

memory/3104-28-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-27-0x0000000007520000-0x00000000075D1000-memory.dmp

memory/628-30-0x000001CB235B0000-0x000001CB235B3000-memory.dmp

memory/628-32-0x000001CB236B0000-0x000001CB236B1000-memory.dmp

memory/628-33-0x000001CB235C0000-0x000001CB235E8000-memory.dmp

memory/3104-65-0x00007FF905210000-0x00007FF905220000-memory.dmp

memory/3104-66-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/2260-67-0x0000000000430000-0x00000000004BF000-memory.dmp

memory/3104-68-0x00007FF768D70000-0x00007FF768D71000-memory.dmp

memory/3104-69-0x0000000007520000-0x00000000075D1000-memory.dmp

memory/3104-70-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-71-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-72-0x00000000031E0000-0x00000000031E1000-memory.dmp

memory/3104-73-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-74-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-75-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-76-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-80-0x0000000009450000-0x00000000094FF000-memory.dmp

C:\Windows\nP2H49EgmC.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

C:\Windows\uoEuwKet5h90g.sys

MD5 9d77ff59a65f3ed0405190cb18d787e9
SHA1 4e5f7c4fd8888352bafa7ee5de3e696a9e6cbfff
SHA256 4ce92697b780fea707db8de927b44d3f1f1119957b288da9450ed240b4a4dda7
SHA512 f04086d9237380eeed3f10cf4675c2a7ad337db77954274e830cde97e7f689b890ba2089fa0126af54213f6f93893e145cbe41b556372a9fe677465462a4031e

C:\Windows\bQM8ehysQL.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Windows\q3ITf5slosddh.sys

MD5 154cc4552fff2c92f55f03921faccb84
SHA1 c43e5d10d6b5422606058e5634b8e3447a1d5534
SHA256 904f1147ae60b98a2cc88794b55c336b4bfd22f914a8435e59b8cd3b98e9abbb
SHA512 17920389f50d8985434b70a7f121a952445f9e1f74b8f58b2a5cfc4cae02807380cb062222bb18212d0bcf7171105f96b38dfffa54b077ea37dc4105fbb4be0a

memory/3104-190-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 3fefedd2d651734aab0aff2f8161db56
SHA1 eda0d013d0db080e6477965234bf4db2aceb215e
SHA256 4a2a561a396876d9ef6387f7f5394313a82d06945aae92d672a39b3db8cc5f01
SHA512 0ac825bf61b063f64e93eb4638ebeb63457309068e8a8ac27ea15b79c0ae7968ec1db6df757d74d9350abfd262d2a834ab54ee47f8d04dbb6451f7133072a56e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 328fe64778d6b22effb27a8285f97bb6
SHA1 bde1f04a0b7021938fcd863ab2a06a447dee2514
SHA256 b810ed457397d134b738b82295df89fd75919ed001e76ac65cda215d7adf4521
SHA512 0d25c056338e40a2785286cd6f3ec0c7d9e424f6e2c1fadff74e6767973164b6224e023b049fd41bb820049ffbbd2cb8689f63da1b61056a6b56969909ff2456

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 9ba47a279b7950e198b6076171704bd8
SHA1 2d40167fb1cffc590d18f00b6ae5a22a7ba2bcab
SHA256 1d855e013b588989a67757730de9fef0ae45fba49359eeeb9ca7ce03089f75c6
SHA512 d048eb90cc64e568aa36c857a19ab9d4ebbb829716ec397d91fe92ab7cf0e5addbb2928cabfdec043ed46db02b2705a079668184474c08f5e7e57d58122d83c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 75e1eb6f9b3cf02628d36c709ef5f995
SHA1 fb5a2fdf95cb3aa69f8181e22fe9d3ef75ab15a5
SHA256 027a16445c86161b6d56b1fdf1f0e33fe6b822b50812dd2058b3ca88e7ab1b16
SHA512 c5e7b18d38203415b3a8054082ab71de72c309cc3a739d32098076edc48e77bbd90dea738934a31d3b47494e4461b8786245c0cfa9c0c0e2b6e31c2caaf5cccd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 fe2a826a9186bcb85f88d9b954715207
SHA1 71e9ef8a19a9633f708ef3db043214d230854e9f
SHA256 46d60f2b4f364803f09f3b0d13611c8bc42178c705204ffe58ab1b92f6c4446b
SHA512 ffdad1fe3c71284b71f4e87a2a15de2f496801ebe522f4c23f94cec0f24ec17e9e6c5da518d8f7ce55debc7a9e94d2d40952e2cf41654529d6692b99efe117cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 b3e886f0a26b67c1234b30c755341758
SHA1 8a881fb559672e95834def740fc5ba017879b0db
SHA256 808b71ea8048ef6e5014fbd1dedbd496516bf963107c8dff13a53d807c60686f
SHA512 66f612ae244a65d623617290f58bd01b8db16fcb98d9b60dca78adc7b2371bfff0ad03dbb244def434e8f243efcef37337a39a30871c64dcd1f6db6e57f50524

memory/3104-197-0x00000000031F0000-0x00000000031F1000-memory.dmp

memory/336-198-0x00000159DC6E0000-0x00000159DC6E3000-memory.dmp

memory/336-199-0x00000159DC6E0000-0x00000159DC6E3000-memory.dmp

memory/3104-200-0x00000000031F0000-0x00000000031F1000-memory.dmp

memory/336-201-0x00000159DC700000-0x00000159DC7AF000-memory.dmp

memory/336-202-0x00000159DC7C0000-0x00000159DC8C0000-memory.dmp

memory/336-203-0x00000159DC8C0000-0x00000159DC8C1000-memory.dmp

memory/3104-204-0x0000000009610000-0x0000000009614000-memory.dmp

memory/3104-205-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/3104-207-0x00000000031E0000-0x00000000031E1000-memory.dmp

memory/3104-206-0x00000000031D0000-0x00000000031D1000-memory.dmp

memory/3104-208-0x0000000009450000-0x00000000094FF000-memory.dmp

memory/336-209-0x00000159DC6E0000-0x00000159DC6E3000-memory.dmp

memory/336-210-0x00000159DC700000-0x00000159DC7AF000-memory.dmp

memory/336-211-0x00000159DC7C0000-0x00000159DC8C0000-memory.dmp