Malware Analysis Report

2025-08-11 01:36

Sample ID 231208-psw94aea8v
Target 84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6
SHA256 84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6
Tags
upx vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6

Threat Level: Known bad

The file 84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6 was found to be: Known bad.

Malicious Activity Summary

upx vmprotect

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops file in Drivers directory

Unexpected DNS network traffic destination

Checks computer location settings

Executes dropped EXE

VMProtect packed file

UPX packed file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-08 12:36

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-08 12:36

Reported

2023-12-08 14:05

Platform

win7-20231020-en

Max time kernel

5s

Max time network

154s

Command Line

winlogon.exe

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1260 created 420 N/A C:\Windows\Explorer.EXE C:\Windows\system32\winlogon.exe

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\RpcPing.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\RpcPing.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\RpcPing.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\RpcPing.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\RpcPing.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\RpcPing.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\RpcPing.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\RpcPing.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\RpcPing.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\RpcPing.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 2392 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 2392 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 2392 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 2392 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe
PID 1260 wrote to memory of 2052 N/A C:\Windows\Explorer.EXE C:\RpcPing.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe

"C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe"

C:\RpcPing.exe

"C:\RpcPing.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Windows\system32\rasdial.exe

"C:\Windows\system32\rasdial.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 f9b03f5bc3f119f2.vbnm34567.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 118.212.235.109:443 down.nugong.asia tcp
CN 118.212.235.109:80 down.nugong.asia tcp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:443 apps.game.qq.com tcp
CN 118.212.235.109:443 down.nugong.asia tcp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
CN 36.248.38.100:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 sp1.baidu.com udp
US 104.193.88.77:443 sp1.baidu.com tcp
N/A 234.2.2.2:27428 udp
N/A 233.123.112.211:23207 udp
CN 118.212.235.109:80 down.nugong.asia tcp
CN 42.231.136.87:80 down.nugong.asia tcp
US 104.193.88.123:80 sp1.baidu.com tcp
US 8.8.8.8:53 udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
N/A 234.2.2.2:27428 udp
NL 104.85.1.163:80 tcp
N/A 234.2.2.2:27428 udp

Files

memory/2392-0-0x0000000000D90000-0x0000000000DFE000-memory.dmp

memory/1260-19-0x0000000002A60000-0x0000000002A63000-memory.dmp

memory/1260-18-0x0000000002A60000-0x0000000002A63000-memory.dmp

memory/1260-22-0x0000000006B60000-0x0000000006C57000-memory.dmp

memory/1260-21-0x0000000006B60000-0x0000000006C57000-memory.dmp

memory/2052-25-0x0000000000160000-0x0000000000223000-memory.dmp

C:\RpcPing.exe

MD5 35b321a3cce787a2bb0d77bbf9eee89c
SHA1 834e1b69166d7ba967fa613a3d90068125a5b067
SHA256 76ce06da4bc59b123e141557e5811680f4a91899ead06fd537981d68e27da07e
SHA512 c8c25d0b1e27ab768a31b6697edd93d9fc35585445abb63a0287634346b5aa9bfc534588edc2cc34f2df5fe622438a5192314dd9aa76b4b01c1707b163c0f8b4

memory/2052-33-0x0000000000090000-0x0000000000093000-memory.dmp

memory/2052-27-0x0000000000060000-0x0000000000061000-memory.dmp

memory/2052-40-0x000007FEBDA90000-0x000007FEBDAA0000-memory.dmp

memory/2052-38-0x0000000001DF0000-0x0000000001EBB000-memory.dmp

memory/2052-37-0x0000000001DF0000-0x0000000001EBB000-memory.dmp

memory/2052-41-0x0000000001DF0000-0x0000000001EBB000-memory.dmp

memory/420-45-0x0000000000870000-0x0000000000898000-memory.dmp

memory/420-44-0x0000000000870000-0x0000000000898000-memory.dmp

memory/2392-46-0x0000000000D90000-0x0000000000DFE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/2392-67-0x0000000000D90000-0x0000000000DFE000-memory.dmp

memory/1260-81-0x0000000006B60000-0x0000000006C57000-memory.dmp

memory/2052-97-0x0000000036D60000-0x0000000036D70000-memory.dmp

memory/2052-99-0x0000000000870000-0x0000000000898000-memory.dmp

memory/2052-101-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-108-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-107-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-106-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-105-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-104-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-103-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-102-0x0000000001DF0000-0x0000000001EBB000-memory.dmp

memory/2052-100-0x0000000001DF0000-0x0000000001EBB000-memory.dmp

memory/420-109-0x0000000000870000-0x0000000000898000-memory.dmp

memory/2052-110-0x00000000005C0000-0x00000000005CF000-memory.dmp

memory/2052-111-0x0000000002AC0000-0x0000000002B77000-memory.dmp

memory/2052-112-0x0000000001EC0000-0x0000000001EEE000-memory.dmp

memory/2052-113-0x0000000004F30000-0x00000000050FA000-memory.dmp

memory/2052-115-0x0000000004F30000-0x00000000050FA000-memory.dmp

memory/1768-114-0x0000000000170000-0x000000000030C000-memory.dmp

memory/1768-126-0x0000000001EC0000-0x0000000002066000-memory.dmp

memory/2052-129-0x0000000005D10000-0x0000000005E32000-memory.dmp

memory/1260-137-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1260-144-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1260-151-0x0000000000530000-0x0000000000531000-memory.dmp

C:\Windows\x4r9Lo83GmI1Lg.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

memory/1260-133-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/2052-130-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1260-171-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1260-164-0x0000000000530000-0x0000000000531000-memory.dmp

memory/2052-179-0x0000000004F30000-0x00000000050FA000-memory.dmp

memory/1768-182-0x0000000001EC0000-0x0000000002066000-memory.dmp

memory/1768-180-0x000007FEBD370000-0x000007FEBD380000-memory.dmp

memory/2052-202-0x0000000005D10000-0x0000000005E32000-memory.dmp

memory/1260-214-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1260-219-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1260-235-0x0000000000530000-0x0000000000531000-memory.dmp

C:\Windows\1DuJEOTB1tHfc.sys

MD5 21e751fbabec800b8bdb35f9e17ead01
SHA1 074675579da30d76c07e3b126c937464e5519dc7
SHA256 296bd26d70375772a9febe53d21f9dae5c254a82dc1e9602b3ddb80ab4fee636
SHA512 73816e2cfacb7da85032b6b8b848bec6b35ca7fa82b03e5f76e771b1842d126d04ed8e3c332174ce4eb5e10f3b2f08fe82c2b6321befc98db8d7a82e4622f39c

C:\Windows\Ktt8orT4phnAh.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Windows\Z3NWZNa8hzR.sys

MD5 28ccb3d2a0ea9fdcd359602f69b7efb6
SHA1 0878427d32dc4acb8be55456959920fb881ed35d
SHA256 67f4d0b4694d9df9f952b507ec4a8a75fae566898016dcbfcf7f5677c3158457
SHA512 2d324218fe3020f81ac556175060b4c93c04d2eac2a4c8e09fc9d7cb32ca8e636979422bf25be248f0857371071b3afbe48dee12ec797c3568f54f5aab2e6215

memory/1260-476-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/1260-486-0x0000000002A80000-0x0000000002A81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabC93A.tmp

MD5 d59a6b36c5a94916241a3ead50222b6f
SHA1 e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA512 17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

C:\Users\Admin\AppData\Local\Temp\TarC94D.tmp

MD5 b13f51572f55a2d31ed9f266d581e9ea
SHA1 7eef3111b878e159e520f34410ad87adecf0ca92
SHA256 725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512 f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

C:\Users\Admin\AppData\Local\Temp\TarCBB1.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 56450d277e2160382e2bb60759a058b3
SHA1 80dfabe94a9a48497e3891d2cf422a5a9439c56d
SHA256 13b3925078aae787adc58467a1a88df780abe247d6cd6cf9f282388ee0d86d5d
SHA512 c23ba8d14b286d6b0c54d5bde7a8f9f78439673821bbc0b0a909921a384532e24f95b76afacf0f040e0bcc8816d101a99511fd26c76074f9766c968eccbc007e

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

memory/2052-592-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/2052-641-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/2052-642-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/1260-648-0x0000000008D80000-0x0000000008EA2000-memory.dmp

memory/1260-654-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

memory/1228-655-0x0000000000200000-0x0000000000201000-memory.dmp

memory/1228-653-0x0000000000200000-0x0000000000201000-memory.dmp

C:\RpcPing.exe

MD5 35b321a3cce787a2bb0d77bbf9eee89c
SHA1 834e1b69166d7ba967fa613a3d90068125a5b067
SHA256 76ce06da4bc59b123e141557e5811680f4a91899ead06fd537981d68e27da07e
SHA512 c8c25d0b1e27ab768a31b6697edd93d9fc35585445abb63a0287634346b5aa9bfc534588edc2cc34f2df5fe622438a5192314dd9aa76b4b01c1707b163c0f8b4

C:\RpcPing.exe

MD5 35b321a3cce787a2bb0d77bbf9eee89c
SHA1 834e1b69166d7ba967fa613a3d90068125a5b067
SHA256 76ce06da4bc59b123e141557e5811680f4a91899ead06fd537981d68e27da07e
SHA512 c8c25d0b1e27ab768a31b6697edd93d9fc35585445abb63a0287634346b5aa9bfc534588edc2cc34f2df5fe622438a5192314dd9aa76b4b01c1707b163c0f8b4

memory/1260-656-0x0000000008FC0000-0x0000000008FC4000-memory.dmp

memory/1260-652-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

memory/1228-651-0x00000000025F0000-0x0000000002712000-memory.dmp

memory/1228-649-0x00000000001D0000-0x00000000001D3000-memory.dmp

memory/1260-645-0x0000000003A60000-0x0000000003A63000-memory.dmp

memory/2052-643-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

memory/2052-662-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

memory/1260-663-0x0000000008D80000-0x0000000008EA2000-memory.dmp

memory/1260-664-0x0000000003A60000-0x0000000003A63000-memory.dmp

memory/1228-665-0x00000000025F0000-0x0000000002712000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-08 12:36

Reported

2023-12-08 14:05

Platform

win10v2004-20231127-en

Max time kernel

71s

Max time network

152s

Command Line

winlogon.exe

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3372 created 624 N/A C:\Windows\Explorer.EXE C:\Windows\system32\winlogon.exe

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\Vz4KUQbnmv.rya C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\8ryb175aaJe.oqk C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\Ei7Zf4cDs2ohc.bel C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\VOCozNrYfmmCSd.sys C:\ProgramData\Microsoft\change.exe N/A
File created C:\Windows\System32\drivers\e1AlX8hN.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\5wiFDIYWNkut.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\9WDAdHWYu3.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\HH7jRDD7eVPZqk.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\drivers\JyOH1WON6SEA.fao C:\ProgramData\Microsoft\change.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Microsoft\change.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 C:\ProgramData\Microsoft\change.exe N/A
File created C:\Windows\system32\ \Windows\System32\kSkC3F.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\2CjOUOYSKmK.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\nfLif9HwVNU.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\RyNRTPOKuZLGkk.ykq C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\YAOp61GTApV5z.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\E4Z0gPahMVPz.ujh C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\5TNsRUMNWOY8G.iym C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\84j8LOrbsxHBI.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\zlyjNL9kBsf.eux C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B C:\ProgramData\Microsoft\change.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\o3tZvMXs5HGId.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\n0nJNXT9Qhmb.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\cP7bDRZnaW.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\W699rznUkqv9rj.mjj C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\sUebfHULWXxwP.vnw C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\D3ZSMiznM1N.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\GDVjeOwCdotO.afq C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\74dA29Ypc2nx.cfi C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\AgQIpoFhVWJQ.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\dDeC22xmIyv.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\PZquoNSJHNwva.hxn C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\UU282jGWDp0j.vhd C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\OZzDJzCROjhdo3.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files\316k1ZK15j.yjl C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\UJ5NxVv2xrcr.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Program Files (x86)\H7R0AHLji6ioe2.wnb C:\ProgramData\Microsoft\change.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\byNUz0dJ.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\kvsujdKQzb.oif C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\3M9Sx8SMWqIM.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\oPYkQ1K5fQ.vrn C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\EdKaCzYZfG.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\3Sgnf3RLNMmlP.msd C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\Y6gBMD7IbrtJE.sys C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\YghuN0oHAL0Mn.wvv C:\ProgramData\Microsoft\change.exe N/A
File opened for modification C:\Windows\Ki74vuhGoAzua.sys C:\ProgramData\Microsoft\change.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\ProgramData\Microsoft\change.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\ProgramData\Microsoft\change.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\ProgramData\Microsoft\change.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\ProgramData\Microsoft\change.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\ProgramData\Microsoft\change.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\ProgramData\Microsoft\change.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\ProgramData\Microsoft\change.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\ProgramData\Microsoft\change.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\ProgramData\Microsoft\change.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\ProgramData\Microsoft\change.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\ProgramData\Microsoft\change.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\ProgramData\Microsoft\change.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A
Token: SeBackupPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\change.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1736 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 1736 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 1736 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 1736 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 1736 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\Explorer.EXE
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 3372 wrote to memory of 240 N/A C:\Windows\Explorer.EXE C:\ProgramData\Microsoft\change.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\system32\winlogon.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\system32\winlogon.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\system32\winlogon.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\system32\winlogon.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\system32\winlogon.exe
PID 1736 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\SysWOW64\cmd.exe
PID 1736 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\SysWOW64\cmd.exe
PID 1736 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1240 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1240 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE
PID 240 wrote to memory of 3372 N/A C:\ProgramData\Microsoft\change.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe

"C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe"

C:\ProgramData\Microsoft\change.exe

"C:\ProgramData\Microsoft\change.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\84eea0bb5ddd6f31fc4bab990ba958e14f887896a12b7a001d6ab41a32c586f6.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Windows\system32\eudcedit.exe

"C:\Windows\system32\eudcedit.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 35.77.123.92.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 f9b03f5bc3f119f2.vbnm34567.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
US 8.8.8.8:53 114.114.114.114.in-addr.arpa udp
CN 36.248.54.254:443 down.nugong.asia tcp
US 8.8.8.8:53 254.54.248.36.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
CN 36.248.54.254:80 down.nugong.asia tcp
US 8.8.8.8:53 58.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:443 apps.game.qq.com tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
CN 36.248.54.254:443 down.nugong.asia tcp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
CN 119.36.90.164:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 sp1.baidu.com udp
US 104.193.88.123:443 sp1.baidu.com tcp
US 8.8.8.8:53 123.88.193.104.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
N/A 234.2.2.2:27428 udp
N/A 233.123.112.211:23207 udp
US 8.8.8.8:53 2.2.2.234.in-addr.arpa udp
US 8.8.8.8:53 211.112.123.233.in-addr.arpa udp
CN 36.248.54.254:80 down.nugong.asia tcp
N/A 234.2.2.2:27428 udp
IE 20.223.36.55:443 tcp
IE 20.223.36.55:443 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 20.189.173.15:443 tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 47.246.48.205:80 tcp
US 8.8.8.8:53 udp

Files

memory/1736-0-0x0000000000900000-0x000000000096E000-memory.dmp

memory/1736-1-0x0000000000900000-0x000000000096E000-memory.dmp

memory/3372-2-0x0000000002E40000-0x0000000002E43000-memory.dmp

memory/3372-5-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

memory/3372-6-0x00000000086C0000-0x00000000087B7000-memory.dmp

memory/3372-3-0x0000000002E40000-0x0000000002E43000-memory.dmp

C:\ProgramData\Microsoft\change.exe

MD5 b5a2475e90b9970f16c50d392b9a16bb
SHA1 0fc5eaafbb93c2d1816f0fed0e1d5b2a3ae57373
SHA256 d2df044b73e57cb2ffab4beae33355301b124b7ca45861c683b97d376019d717
SHA512 c2afc2ff49a578c67921290d598bff0e5aa0149731b4732d6ecdb3a44e71c3aa20c734e6e63e4ecaeb668f49c168bb1cf2a72d6f711332457b05b7d1fc65b9be

memory/240-11-0x00000269EA730000-0x00000269EA7FB000-memory.dmp

memory/240-14-0x00000269E8DE0000-0x00000269E8DE1000-memory.dmp

memory/240-15-0x00007FFECC990000-0x00007FFECC9A0000-memory.dmp

memory/240-13-0x00000269EA730000-0x00000269EA7FB000-memory.dmp

memory/624-20-0x000001FBC7A50000-0x000001FBC7A51000-memory.dmp

memory/624-19-0x000001FBC7A20000-0x000001FBC7A48000-memory.dmp

memory/1736-18-0x0000000000900000-0x000000000096E000-memory.dmp

memory/1736-30-0x0000000000900000-0x000000000096E000-memory.dmp

memory/3372-31-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

memory/3372-32-0x00000000086C0000-0x00000000087B7000-memory.dmp

memory/240-33-0x00000269EA730000-0x00000269EA7FB000-memory.dmp

memory/240-34-0x00000269E8DE0000-0x00000269E8DE1000-memory.dmp

memory/624-41-0x000001FBC7A50000-0x000001FBC7A51000-memory.dmp

memory/240-57-0x00007FFECC990000-0x00007FFECC9A0000-memory.dmp

memory/240-58-0x00000269EB040000-0x00000269EB041000-memory.dmp

memory/240-63-0x00000269EB040000-0x00000269EB041000-memory.dmp

memory/240-62-0x00000269EB040000-0x00000269EB041000-memory.dmp

memory/240-61-0x00000269EB050000-0x00000269EB051000-memory.dmp

memory/240-60-0x00000269EB060000-0x00000269EB061000-memory.dmp

memory/240-59-0x00000269EB050000-0x00000269EB051000-memory.dmp

memory/240-65-0x00000269EB040000-0x00000269EB041000-memory.dmp

memory/240-64-0x00000269EB450000-0x00000269EB507000-memory.dmp

memory/240-66-0x00000269EB650000-0x00000269EB65F000-memory.dmp

memory/240-68-0x00000269EB040000-0x00000269EB041000-memory.dmp

memory/240-67-0x00000269EBA10000-0x00000269EBA3E000-memory.dmp

memory/240-69-0x00000269EC840000-0x00000269ECA0A000-memory.dmp

memory/240-70-0x00000269EAE30000-0x00000269EAE31000-memory.dmp

memory/240-75-0x00000269EB040000-0x00000269EB041000-memory.dmp

C:\Windows\EdKaCzYZfG.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

memory/240-82-0x00000269EB060000-0x00000269EB061000-memory.dmp

memory/240-77-0x00000269EB050000-0x00000269EB051000-memory.dmp

memory/3372-74-0x0000000002980000-0x0000000002981000-memory.dmp

memory/240-73-0x00000269ECBD0000-0x00000269ECCF2000-memory.dmp

C:\Windows\Y6gBMD7IbrtJE.sys

MD5 f775833a34b09c2e325c2fd7cfdea344
SHA1 0b2bd156c02c1ac93955846e97a4bf967f405a61
SHA256 a4a4abd8c223e3f75fac0a82af2c92d7adb5133a1f18e0d5eb9abbcb93fc6803
SHA512 d453ed908506e034127c3cfff964d10920b33b80c0f92a6529156238b649c8ffe774e9c66bcfd75bec8eb90e2a69d4bb7d3af2221e15610cf9d8c6038f3c89b8

memory/240-138-0x00000269ECBD0000-0x00000269ECCF2000-memory.dmp

C:\Windows\Ki74vuhGoAzua.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Windows\3M9Sx8SMWqIM.sys

MD5 b9076ace2d4d707301cc87c5c19817ed
SHA1 7eae50f77c3e4eb950f9141ef7e10f8a2f0adc4e
SHA256 82896b855e5130eb7a797ed7b6e90773438f9d1bad36f90472cbb505f8466e77
SHA512 a6ba8619035db8fe13fc9e5b368a34bf65ce4e5fde23a63a242e024f35727a993fb9d8f8504383ef8a5ad781e2655101b771b9f71e7d31266736191fb509369b

memory/3480-302-0x0000023C4DB30000-0x0000023C4DB33000-memory.dmp

memory/3480-304-0x0000023C4F750000-0x0000023C4F8F6000-memory.dmp

memory/3372-303-0x0000000002980000-0x0000000002981000-memory.dmp

memory/3480-316-0x0000023C4F750000-0x0000023C4F8F6000-memory.dmp

memory/240-317-0x00000269EB6B0000-0x00000269EB6B1000-memory.dmp

memory/240-318-0x00000269EAE30000-0x00000269EAE31000-memory.dmp

memory/3372-321-0x00000000029C0000-0x00000000029C3000-memory.dmp

memory/396-325-0x00000202E3EF0000-0x00000202E4012000-memory.dmp

memory/396-326-0x00000202E4030000-0x00000202E4031000-memory.dmp

memory/3372-327-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

memory/3372-331-0x0000000008EA0000-0x0000000008FC2000-memory.dmp

memory/3372-330-0x0000000008FD0000-0x0000000008FD4000-memory.dmp

C:\ProgramData\Microsoft\change.exe

MD5 b5a2475e90b9970f16c50d392b9a16bb
SHA1 0fc5eaafbb93c2d1816f0fed0e1d5b2a3ae57373
SHA256 d2df044b73e57cb2ffab4beae33355301b124b7ca45861c683b97d376019d717
SHA512 c2afc2ff49a578c67921290d598bff0e5aa0149731b4732d6ecdb3a44e71c3aa20c734e6e63e4ecaeb668f49c168bb1cf2a72d6f711332457b05b7d1fc65b9be

memory/396-328-0x00000202E4040000-0x00000202E4044000-memory.dmp

memory/3372-324-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

memory/396-332-0x00000202E3EF0000-0x00000202E4012000-memory.dmp

memory/240-335-0x00000269EAE30000-0x00000269EAE31000-memory.dmp

memory/3372-336-0x0000000008EA0000-0x0000000008FC2000-memory.dmp