Malware Analysis Report

2024-08-06 15:34

Sample ID 231218-j4g2nabaf5
Target 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
SHA256 1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
Tags
discovery persistence evasion ransomware trojan wannacry spyware stealer worm chaos aspackv2 bootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518

Threat Level: Known bad

The file 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip was found to be: Known bad.

Malicious Activity Summary

discovery persistence evasion ransomware trojan wannacry spyware stealer worm chaos aspackv2 bootkit

Wannacry

Modifies Windows Defender Real-time Protection settings

Chaos family

Chaos Ransomware

Chaos

UAC bypass

Deletes shadow copies

Modifies boot configuration data using bcdedit

Sets file execution options in registry

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Disables use of System Restore points

Modifies Windows Firewall

Executes dropped EXE

Drops startup file

Loads dropped DLL

ASPack v2.12-2.42

Reads user/profile data of web browsers

Checks computer location settings

Deletes itself

Checks installed software on the system

Checks whether UAC is enabled

Writes to the Master Boot Record (MBR)

Modifies WinLogon

Enumerates connected drives

Drops desktop.ini file(s)

Adds Run key to start application

Drops autorun.inf file

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

System policy modification

Opens file in notepad (likely ransom note)

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Interacts with shadow copies

Suspicious use of SendNotifyMessage

Kills process with taskkill

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Pre-OS Boot
T1542
Bootkit
T1542.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Indicator Removal
T1070
File Deletion
T1070.004
Pre-OS Boot
T1542
Bootkit
T1542.003
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Defacement
T1491
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-12-18 08:13

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral27

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Butterfly on Desktop\is-L437P.tmp C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
File opened for modification C:\Program Files (x86)\Butterfly on Desktop\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-RGM3V.tmp C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-82QL2.tmp C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-34DNQ.tmp C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "61" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "61" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9626CC71-9D7D-11EE-B578-EAAD54D9E991} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4105" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ce9d0866286369940e771ef63e87aff5ec2a6afc78d8a4a136afa9af7ab6c23a000000000e8000000002000020000000393fd383b61520eb20ec44a1956cd37fe74470425911f369f15ad9a58770edac200000001c2e645db55a1190ca6b3338719c759cd310f0e37e082656798abbb624ed27e2400000000e51f386af6b16d602935dce0a9930f45731e32160f0d7677d6c3f6ee6f94cc1e53459ca2b2eadd89fb80af335603b204a990c1b55987685b34956c89d79af85 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09e8a6d8a31da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409049189" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "4027" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4123" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002a8dc1f7a2ea84dcb6a80c583211048a3814055ef9a2032ff2cf9bd681c1cc65000000000e8000000002000020000000f33f276267db750719991b2ee59c5f2907a72c145a41547f856f3dca6688e9ed900000000e5d85b4c77ece8ffaceed7689c72ad3f1b708dbdc247c4f1fe6f67d7d10bb3ea04cda8bccd68428d8d19486bb78c1abcb4523ef3c76c2f2ad4742e08715809a2f8a217245339c15fe5a1ad762e7a2fd7a6e556e9d30718da157ebad9697bd5f5770159f29e5acafdbc1b9eebfd9bf92bf68fc6277dd46cbc458ce9d45a4367bc60679f7d58bf5b25ecae404be0b447440000000fa969763e2f2e23695423a7cd7cabff91488b4ffaf26cfb8a48227f2b838dc85223fa1c8cef9159fad8099611d02209ff82729a916067af4de7539752427e3b1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "3991" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "4105" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3991" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4027" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "4027" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "4105" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "61" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "3991" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2344 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp
PID 2908 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 2908 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 2908 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 2908 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 2908 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files\Internet Explorer\iexplore.exe
PID 2908 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files\Internet Explorer\iexplore.exe
PID 2908 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files\Internet Explorer\iexplore.exe
PID 2908 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp C:\Program Files\Internet Explorer\iexplore.exe
PID 2668 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2668 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2668 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2668 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp" /SL5="$30156,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://freedesktopsoft.com/butterflyondesktoplike.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 freedesktopsoft.com udp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
GB 142.250.200.14:80 www.google-analytics.com tcp
GB 142.250.200.14:80 www.google-analytics.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 157.240.210.14:80 connect.facebook.net tcp
US 157.240.210.14:80 connect.facebook.net tcp
US 157.240.210.14:443 connect.facebook.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 www.googletagservices.com udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 142.250.187.194:443 www.googletagservices.com tcp
GB 142.250.187.194:443 www.googletagservices.com tcp
GB 142.250.180.1:443 tpc.googlesyndication.com tcp
GB 142.250.180.1:443 tpc.googlesyndication.com tcp
GB 142.250.180.1:443 tpc.googlesyndication.com tcp
GB 142.250.180.1:443 tpc.googlesyndication.com tcp
GB 142.250.180.1:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 157.240.210.14:443 scontent.xx.fbcdn.net tcp
US 8.8.8.8:53 fe0.google.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2344-1-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-B3H3H.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/2908-8-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2344-9-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2908-10-0x0000000000400000-0x00000000004BC000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-LJI67.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2908-19-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2908-20-0x00000000002C0000-0x00000000002C1000-memory.dmp

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5 81aab57e0ef37ddff02d0106ced6b91e
SHA1 6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256 a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512 a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

\Program Files (x86)\Butterfly on Desktop\unins000.exe

MD5 1fee4db19d9f5af7834ec556311e69dd
SHA1 ff779b9a3515b5a85ab27198939c58c0ad08da70
SHA256 3d550c908d5a8de143c5cd5f4fe431528cd5fa20b77f4605a9b8ca063e83fc36
SHA512 306652c0c4739fce284e9740397e4c8924cd31b6e294c18dd42536d6e00ad8d4c93d9642fe2408f54273d046f04f154f25948936930dd9c81255f3726f31ee65

\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5 d878cc1292f398a1ddb81cb3c33deec4
SHA1 006d7989fa4fafec6f600f97c2568f9abd778f7d
SHA256 04f0249051e5df983cabcd4d42452cd34c89a75bfd55d1badd690d030c10f6ed
SHA512 7c1ad56f6b7506592a0f18ab6b80cccfb12b7d75db12c2ee88e89afecce734ca3e947e9a349f34dd3db323ed07a97e7df5af1122028127a9bf7bcec15fcbf90a

memory/2880-52-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2908-56-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2344-57-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabEF1.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarF9F.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\C3K85OER\freedesktopsoft[1].xml

MD5 2f3721077a76a82df464e6d7a22d1849
SHA1 ca928ab7f4991499ffca5cc7a9f073b3e5a98cad
SHA256 56118a1700b44aea6dcc40d73c43c6acd08d4f112d0bda92e2f9da3a6396ba88
SHA512 9630a9f28d5e92cd8c75c2def77cfbe0e20fcec882c55001a07fe9fe49dd3a519f08d45ff8487bb3950d745465607dac7272d55f58f8c1982ef57a65889adf9d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\C3K85OER\freedesktopsoft[1].xml

MD5 5b103281af7a7397e53d6b9a12d02f24
SHA1 7c32a15f29bdb8f5f28e0bd5d84594d53af7b5f5
SHA256 face941139533d364040a20a078573dd613d4be8ef802210d1961dec98f2533b
SHA512 e124ee1d02234b91fca4f7c6525416931e992013dbb73981d49697a85e75066a05cee8a96d02cb1ec40a06317c6310123cd57a90fc211cf0ec15cf64fe8409bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_2904BACC9596DCBFDE1A1AD512218F17

MD5 78bc758f7aacdf4947a1b8b3bc827449
SHA1 6e01bb72bada707dbaeaea7300b59aad2f72353d
SHA256 0f621e9c15f509aa02842928b7997526715b52b61780b60c06dbdde14a3c9175
SHA512 15a17d5367643da0c42437b20c138277a86a3affecb619006396ee0e6b6119d18ad10602882a56cc0edf4d4ba7bd428ee32adea1da0cecd340f6e59024b9cafb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_2904BACC9596DCBFDE1A1AD512218F17

MD5 618c421ae8b21ead9b75846f59212e90
SHA1 5b0d86043df613f04ce45553bd97cdffa6989f8c
SHA256 0c09bb037f1099544939fa6a91412038f1fde0168eefbb64b6e0ddbcbd964cf0
SHA512 ff31251231a50ea394a59f5c042f159a68a9ca0bebc871dd4db59e8b371ddce2bd227a4b57092dcf0a9949a665e5c8b8b53b31841b72e40e5c12b02845cffb58

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\f[1].txt

MD5 e0a8b8097300144ccee5948026827cf3
SHA1 5a693ff5850843af1797cfc8781322934e812051
SHA256 565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43
SHA512 e19564212d6454eccdcb772b9dd4ed6261e2f9a010da30dcc55098eabb4b30e9ef458e92af84b73f67bb68675d62dde616e63e48f589fd5f8b0837d9445f20c7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\f[1].txt

MD5 7bc13e084e4b651981936b63e5262df3
SHA1 f06efe403f59d8ff15a771596fa7e4121b2e1421
SHA256 425c887bd8caee3ae355f251cb53649dd492f884523e1609ce4437ef70edc727
SHA512 4f9363e3fd5c651aca56a72ee5935b2421e9711db56c3505df6570efde6ff092cce7e7dde6fb40d27bbe43bc9f3ae6fe48e0efdfc6f3bf3b97776250d5b4109d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\f[2].txt

MD5 43df87d5c0a3c601607609202103773a
SHA1 8273930ea19d679255e8f82a8c136f7d70b4aef2
SHA256 88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a
SHA512 2162ab9334deebd5579ae218e2a454dd7a3eef165ecdacc7c671e5aae51876f449de4ac290563ecc046657167671d4a9973c50d51f7faefc93499b8515992137

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\ufs_web_display[1].js

MD5 687f36959d3133324c89c89fa708b3da
SHA1 d95eecef21ac59ff2d9359d452394ebfdbcd8181
SHA256 566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a
SHA512 cd732600d7f757fd7d031c035db9445b2564936a79c1d8ad7b481fc295989c7d2c10bfc0c0cec53656c99ce5479a76d5f231ddf2322c9ae2496611fc287b4f5a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\f[2].txt

MD5 7528067fcf996e8d6cac25c95051baaa
SHA1 92267f58a3ab0959a5e3954c9c9c8b839218584f
SHA256 60fed3181b6988afdf2820001db18b9ebde443b9899fc4e89c6ae5c6bf6bdd33
SHA512 b89d7f77c4e16ecebe6c03c06faa6cc08232c2d462287a846e281e599c9ce6e357b324971387124f934d6526c47b466f4f739f962da637dac8b5a0e2987c860c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\sGrT9ysWSs9_t34896WOusE8LdS7rNyFrC7hJy7peMg[1].js

MD5 d48d74adfc515a71970fdd0ebbdbf6c4
SHA1 fa16d2837d440b0d29b8311ef819b2a4d324656b
SHA256 b06ad3f72b164acf7fb77e3cf7a58ebac13c2dd4bbacdc85ac2ee1272ee978c8
SHA512 60f9683fb6d79a52713b301f853bffda4dd72944b4699eaa388be5a9d1cec929b2a21b584d9f11fc33d236438088cc5468ef1555c9e4b7dd816bdcc5c34022ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\favicon[1].ico

MD5 972196f80fc453debb271c6bfdf1d1be
SHA1 01965ba3f3c61a9a23d261bc69f7ef5abe0b2dc3
SHA256 769684bc8078079c7c13898e1cccce6bc8ddec801bafde8a6aec2331c532f778
SHA512 cb74de07067d43477bd62ab7875e83da00fad5ac1f9f08b8b30f5ebb14b1da720e0af5867b6e4ab2a02acd93f4134e26d9f1a56c896da071fc23a4241dc767f1

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wz5r4lq\imagestore.dat

MD5 6a00b8a19485d782bf7fe123b8898aff
SHA1 901d22f5a95ceffb266f555abb080007c5c69d59
SHA256 73ab5855de20e32d0aa5925d10a0f20d3301b10cd3297a4cc89b87fd6e3538c2
SHA512 8da4cb26100044b3f711c34c741e457fcd9aec9196cffb22e3494a48046a044067d2f6ff0f0740cc56879436cbd557e90253aefe30fda59ed47292ef0a055e99

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\3TW25EW0\www.google[1].xml

MD5 39a8b8d0f3053380197785d28a884351
SHA1 d126c93976c1eb1087a3a71fb744df2e58d088ce
SHA256 7025f6773a217a2a52533b4e850907f4ec9ed43d8a5dba54f8a8c33847586599
SHA512 e7655a0611ffb09f9c233f06fa1e255c884f252be8ee2f49f94c2d362dec1e70be31656b84cac9be2e77db248259c6ea7bb2d3551afdc24df23c9128523b9843

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89ce09f5af11d17c8e35473612da1b4b
SHA1 e08b5ed220d68ba41f41424bb5cbfc8ba41062dd
SHA256 dbc9c337c9f9929e8ecf637fa2681957a1936ab68575a7ec6481163f0362008c
SHA512 80c08531693b0464551a0d5f36f7fc295bc31c9ae10de44628bc13336ed7af3202fd4c9328d3f6a002e94d014c269eb8b0e1d144d1794e5357e765bf40a34e3a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f05f947bd663a7c9bc1d88175bc182c4
SHA1 51deb4402153fddb391b27ec1baa95d7c1289c34
SHA256 3d078e416179048828cf9ddbe272730372aedaa8057bb5f35414fd698b0e26ef
SHA512 ed16483b508dc54d877a8c93a1327c83c21b7fc0dfb06fb19c57af819091063cd3c22b3ac73da10e38fb8f9c396f7b09140e1a011db33f62b7ce956fdcb27cac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8e3b55d42c247e8a257f4abe376ac9f
SHA1 9e789a99039cfa6cbe4c0cc53800def949ce198b
SHA256 aaaf6bd1eb1a86c7da73bb504c6cfc6005c1a16b43c725ccd911690da0ef57f3
SHA512 f48eee53ea3f82e39fe17000335d2e6c324b4a6871bc3979b57b61019e05e8b8cc8a2c9f493ce079d5c049a9c2532c6ac957ef106cbab449b33fec791aff2be4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b2a34036099d87a616f94182b024807
SHA1 0623d1167c0ab647e599213a3f26bb8efb34965b
SHA256 6bbe7bb7ba71f21808380c4bc9412639448f560d7ce227ef5924d877a730cec5
SHA512 694208e95363252d2c1689e490b7abf31bb693e7fbdb17eddcb0e03c2b751cff5d6a36a80921f611e641f952277da6f5a071b20e1b9f4de3a8c7c8a49c3ea14b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5382a1bc521c8a8b02da0b629140dcae
SHA1 d9e7fd4f6fcbc4bb39149ded474a7fe969db4423
SHA256 f560e8c6213fb93e417fc611e3952e5487924cdc0ce9e213006e689277df5ad8
SHA512 29897a3ef8002c4f5eae87815870ecd386aa22d0326f5a9136c6e1e0beff7761588c6604cb64ce9485b9cd363ee15c7deb92c6dd5398bd68ee49b52fc07472e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8bc8ec7764c4d56c908170bf691025f0
SHA1 7a21337fdf3044b320527e72db516e24c1e224bd
SHA256 4bd3ee4a9d1aba34764f30122a082c36e9bd82f7cabbf394dc9f43897c32fa67
SHA512 9306b6b12c7eb581f6f970453c729845e4139e99dbdd47f6d58cf111d2cb2e0f0aa7fb7ddacb07fb716605c151034d1f99b4373b0fafc37f604686a38f4d4a0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d79786bc311efd500c407ca26fd33702
SHA1 caae03cd746f76f81fdf5bdf16e21aeff9b159eb
SHA256 b6db51dd310a478e8d9df021785b01d520dd98e60080dc28745359d82706ae31
SHA512 b06f7af97106dd055dde49ae9aef474651a1f0b3d0b38413a1286fb91d58d5f986091c3c4c280378a9d3e22c9d540ede9c272526254c95fbabe76dcda296b405

memory/2880-555-0x0000000000400000-0x000000000070B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bfb34757b93a9b874102b9723ccebac5
SHA1 21e09bc03f2a93afa50054bac31c344aef269e13
SHA256 64e58d3c0dfc1344800a5c86a1928c2f74e1e8fdff7f14b4ce0c1dfc0fdd782f
SHA512 e60af858dfc2899a27b1907bef82143d54ca773b0ab0b29d832d29022325682259adee16de9889d67e45fdebf883d52c23c4b7273371bc4e597574ccb8ba0bb4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 566861a990533317cae20ab4b7c08dd5
SHA1 95a447b08bffbd91b62b7cdbe111b3cce625ca65
SHA256 06ac457fc5f798b761d207734ee3482833b833fd0a2244a5c5a002350ce9cbdf
SHA512 d5d3ba200305f16c8043411a72bec35ea17dc954cefe4660ed6e76aeeaa27853dd25b82f5b3e9db8471c1a37bbbee392dbfef4cb412888936da25d6628999cce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86c8b3dfce00ef3ed81f8c0e4b4f793e
SHA1 7bc30008773f2eaf6595f4193821f3eb838dd9d1
SHA256 8ce1983fc3697fdb13795d0bf17c9cdfb1889a6a849d06de605b329912c8a4eb
SHA512 73370a08a79152fed8fadd7a8260a9cb7c9ed7d5a8e2e30e2ae541cc3f0aea5e1f835d11e9fc4ab8690b3fe73ba030a1d483b21d7556e7d1b97c4a65625f7492

memory/2880-754-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-755-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2880-756-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-757-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-758-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-759-0x0000000000400000-0x000000000070B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c856e69fb693dbe8bfaff34d1e507cb
SHA1 c2f421f1616f8c62a5815825fe01b4579bf52540
SHA256 d1cff24377b1f8d50c3efc567f84e098a3026a32167e4acfb32913dac895af67
SHA512 efb01fcbac6d938ec7abbe42c8ab474ecc91ffe88b8c5064f2e7c1cbbb1415a835f29f3c6190ce966a99869085e12619ab791206818c858089a8882f862d1053

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e23b14e5cb606d403f24b85237d5046
SHA1 80480bc42f22f01b331ccccf091c5ec262b644d0
SHA256 e166ce82cc124198ca4bfb3ca613ceac3bf2ec203fd2c9356f5a224bf327b4da
SHA512 e7d64f62ad372fd911bc9a032f1daaab85ec1013e3ada0257d8fbdc87c5215914993cbd027cb4caba9f6d23bca3910cde0d4a3e3a2bf382d375c52bde8796b03

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13576c7a4450f33207d66213e971636c
SHA1 5d5af4a2cb2c87ce1356d6d5b78cb3925c9d95ad
SHA256 c0939d17a5c9e491843af6119e910965f3d644ebafbd44709ddeac29bb0b02f4
SHA512 cc442255ad40709089a7db4d86b6f9eb4fa30191b46a5e796f8bf8513a08e9a6005f54f594836d0a39d63d7d477060a8f02104cee96c69ccf1af9586b1fd0fc1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fcb684936bba3465a33e888449795e38
SHA1 631ac2e748725558d86f25700a54da182b06fb5c
SHA256 907526815fbe4627d3be21c8cdea8286f79995f1e662c7bba23d57b8ea7a4b73
SHA512 71966cc40f07b8aab495a3f04b89377992718b39c37f7c6a2de080f957ac5ca71010d47266c2d56ab5301a6afa1bccb1a3247637fea793625dd1fc4b50093f1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0bf13960414936190d5967563e54d5b3
SHA1 f750411ad7b1a469c91d177bb37a4b785eb64e51
SHA256 9d6d028dcef115bf058547891e570bd44b6e0ca1997a3fd49fcea77410f3eb11
SHA512 f582174180505c7af541476eb342e474eb37848b625b394f73e82fec08076c5980b2a523f05be2c2851a6536dafda880bc4014cf4ebfe4b8927a731680ba4d06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf4a00bbae9f379b5396fc862cf74620
SHA1 81d339ff7329dda81f31a71a45f4efc5e56e26ba
SHA256 c00d9e56de95294af7e241e65f4216e53ced780c524b787d70e64a7ae0593854
SHA512 4e61cf83abd3d4d071b869084af832686ccaf84f533da090149293601a7a431fff69786b1f7697f3a3fd74bed095f23ffc77637303b5128fbc945875463077ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 34b80fe8c220a6cec87c2df104455a91
SHA1 39e0a5c9f7a415cc5cb7ef3ae06f77d1dfcdcdde
SHA256 3f7a6b136b6857dceb7ea9422f6e01c6ad404773f6f8ea2fc7e71a0be7ff9ca0
SHA512 0c13b39072a3b141c74bdadce97249aea4c057123675364bb3d64825fbc2709596c02d6964cf010d3d6d24f5d67548b91d60968fc17abee8d9af260b67c6e0c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e5eacb219bf084e8ddb9b7658feab2c
SHA1 a7af1eced29468a8e0c5592bc4428d7204d6ec40
SHA256 cfd1d4731b2f3a508ed5ef87a8d527c1326d442ebeb715196bf3ffae7077733a
SHA512 6d20dd550cf04e3e4a06714eb4e3111ec5d0b480230b82a66c2e0c0eba91c077edff6461c1f34075b036b6c3eba2e7297b3bb690b9e48f980aa96bd837bb2f78

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5a40b31068f86bfb0bcedaaa86aab17
SHA1 f16067df1a46ccb8ee2fb417f3e87ada61d8a02a
SHA256 a4a03c01c2d0e77123d333f050c0668e64916ee87213aa36d27cc797099e4b09
SHA512 206a0a23a7475fbf3f5e3fe6f86d3a0c20961bcc8a27af3cbc1eede1bdb1a8089b683528e11c6add06c4f67bf8e2036a1d31ddd3cd0f8bd997af2075de390a3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 729da2915d2bd5ec3933101e5ab69b40
SHA1 a17412db3919a185d9ceeadc489b366be9032e86
SHA256 2e47a65ba8802480b0e3abcae357e5c49ed330f5388fc22d3cb9326b2243ed00
SHA512 b9880e8572c63c3be9f38f589914d87de79ed2df4db5b9f0ea185c6abb99898c7840a7f9867a5a395a887f94f15c81b898c450fa15a1c026aa9d4a1433d3c081

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9683cdc666905cc35e19fb434eeeb939
SHA1 aeb3f35fc85d665d889866186df6d3dcf79b8515
SHA256 cb8110735664d44c6d289ca5e473bce02623a020cb7ac3372c9789b49e1e0acd
SHA512 713225bcc4dab98247e424eb78c68f00b20100a78c1b8e03b13e49c2a9295867a47e6aeb98965701f53bc6dbb001540b650cd00a6aef31e7164cbebef00a380d

memory/2880-1192-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-1193-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-1194-0x0000000000400000-0x000000000070B000-memory.dmp

memory/2880-1195-0x0000000000400000-0x000000000070B000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:16

Platform

win7-20231129-en

Max time kernel

140s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

N/A

Files

memory/1108-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1108-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1108-14-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

141s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

N/A

Files

memory/2336-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2336-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/2336-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:14

Platform

win10v2004-20231215-en

Max time kernel

18s

Max time network

22s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3904 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3904 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3904 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3904 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3904 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3904 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3904 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 3904 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\SYSTEM32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3951855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

memory/3904-0-0x000001B949AF0000-0x000001B94A58C000-memory.dmp

memory/3904-1-0x00007FFCAF900000-0x00007FFCB03C1000-memory.dmp

memory/3904-2-0x000001B9649E0000-0x000001B9659F6000-memory.dmp

memory/3904-3-0x000001B94A930000-0x000001B94A936000-memory.dmp

memory/3904-4-0x000001B94A960000-0x000001B94A970000-memory.dmp

memory/3904-5-0x000001B94A960000-0x000001B94A970000-memory.dmp

memory/3904-13-0x00007FFCAF900000-0x00007FFCB03C1000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6E1F.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6E26.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 3024 wrote to memory of 4796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 3024 wrote to memory of 4796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2876 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2876 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 3620 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3620 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 3620 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2876 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4476 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3024 wrote to memory of 4972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3024 wrote to memory of 4972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 60721702887269.bat

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp

Files

memory/2876-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 83aa6ee84a4539f28e43436442e0eb5f
SHA1 a05babcc3874b40844b9eda63e529a7264853eb4
SHA256 c700e307339d2e82b389e073553f993c3daddb9b75878957ca7b72a0ba3e9baa
SHA512 4f7d0b3ca669a4dba25686d0f6508fa90c1bbcdecd162076b14a5490923cd81ce4106eb197283889a15fe57f09175d21dd9ee99550ee1a477739ea29f52d90a5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\60721702887269.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 4f9d411d5b058938ce29b0a25d2a8f15
SHA1 d5f0cac9549aef3836decea583aaa493b08c4a1d
SHA256 e588886a5477f61c2b691242bcb36de52ff66fe9826201af1ff7a832b4c34f08
SHA512 b9029a0fe7279ae19909b6a292fe083d5cdf1b93489d4007fa9abea783a203ddfe4f6afdfe387e868f4e23ea9547da08da4c78199d8f61b9c419e171738ca32d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 ffb5796426d1b006078e2ba4794f1f05
SHA1 aa07798051f5d1b96c569cc71e32319df4fef28e
SHA256 74365b3fda2730db34964c80106563627bc51b34e6921f4a882eeb980505a173
SHA512 b0224530fd2561d754efd3afced7172efd1e6011713651e9faf1070af0aaecd65ffc8e53ee4889736c6ca49242441ee42c8dab16acd1d17294c65534b150ae91

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 e628d3526b86b090c1ae9abbf93f361e
SHA1 cf5d9031239b2c5e0ed82b2abf31cb9c5f933d6b
SHA256 ed16cd30e0921e5b8861986d67fa0e7759b21a4b60b83aa23c732743d02d9f02
SHA512 be1c183452b689f8d0657c24bb06cae12fc82f8709bf13dd5619a91cc456c82f7c49ed755cdc3105c9819090fe833d135194916d443f881b3612f28d043b045e

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 8fbd7228eb8c3d8f32e5b5f8798157da
SHA1 f85173d8c745c88bd1655db0014016b0583f4f1f
SHA256 28df383262f4a111772b49fe0ddc622ce65e34b8eb18b8807fd9ebf02ed83265
SHA512 6013f6f8ba6f9a7f5c175dbb87d35207e45947341610e8386986aa4460add121b0b6ea4560423be42f47fd8a7d5ccdc55852dd0420feae25671526ceacd2397d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 8877ef4c882ca62200533619ae9423bc
SHA1 1ab230e01d6b2c75700a7ba6c218e3a1e60499bb
SHA256 ba9b6f2aa96ea35b94fdac51e3196560dc0f50c8a4df3908dc269de331927b34
SHA512 7eab75aa5bc1a0ea3885d0c339615c0a9b59b792c725f12ca8c10909d93f7338cbbdcc3ba9739e0d20fcb9dea34d457a8a3d7e1f510832ab840145c0f85b814b

Analysis: behavioral18

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:16

Platform

win10v2004-20231215-en

Max time kernel

121s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 6.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp

Files

memory/4516-0-0x00000000007E0000-0x00000000007E1000-memory.dmp

memory/4516-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/4516-3-0x00000000007E0000-0x00000000007E1000-memory.dmp

memory/4516-5-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/4516-9-0x0000000000400000-0x00000000004DF000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

90s

Max time network

149s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\README.md

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\README.md

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 6.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:14

Platform

win7-20231215-en

Max time kernel

11s

Max time network

15s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2488 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2488 wrote to memory of 308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2488 wrote to memory of 308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2488 wrote to memory of 308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2488 wrote to memory of 308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/1464-0-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/1464-1-0x0000000001290000-0x000000000193E000-memory.dmp

memory/1464-2-0x0000000000B20000-0x0000000000B60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/1464-15-0x0000000000B20000-0x0000000000B60000-memory.dmp

memory/1464-16-0x0000000000520000-0x000000000052A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/1464-25-0x000000006B540000-0x000000006B852000-memory.dmp

memory/1464-27-0x0000000000B10000-0x0000000000B1A000-memory.dmp

memory/1464-30-0x0000000000B10000-0x0000000000B1A000-memory.dmp

memory/1464-29-0x0000000000B10000-0x0000000000B1A000-memory.dmp

memory/1464-28-0x0000000000B10000-0x0000000000B1A000-memory.dmp

memory/1464-26-0x0000000000B10000-0x0000000000B1A000-memory.dmp

memory/1464-31-0x0000000000C20000-0x0000000000C2A000-memory.dmp

memory/1464-32-0x0000000000C20000-0x0000000000C2A000-memory.dmp

memory/1464-33-0x0000000000C20000-0x0000000000C2A000-memory.dmp

memory/1464-34-0x0000000000E30000-0x0000000000E3A000-memory.dmp

memory/1464-35-0x0000000000E30000-0x0000000000E3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

memory/1464-73-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/1464-78-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/1464-843-0x0000000000B20000-0x0000000000B60000-memory.dmp

memory/2936-844-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/1464-846-0x0000000000C20000-0x0000000000C2A000-memory.dmp

memory/1464-845-0x000000006B540000-0x000000006B852000-memory.dmp

memory/1464-847-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/1580-848-0x00000000026E0000-0x00000000026E1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

148s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 6.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/1168-0-0x0000000002210000-0x0000000002211000-memory.dmp

memory/1168-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-2-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-3-0x0000000002210000-0x0000000002211000-memory.dmp

memory/1168-4-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-5-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-7-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-9-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-10-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-11-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-12-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-13-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-14-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1168-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:15

Platform

win7-20231215-en

Max time kernel

36s

Max time network

39s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 760 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 760 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 760 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 760 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 760 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 760 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 760 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/760-0-0x0000000000920000-0x00000000013BC000-memory.dmp

memory/760-1-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

memory/760-2-0x000000001BD00000-0x000000001CD16000-memory.dmp

memory/760-3-0x00000000003D0000-0x00000000003D6000-memory.dmp

memory/760-4-0x000000001BC80000-0x000000001BD00000-memory.dmp

memory/760-5-0x000000001BC80000-0x000000001BD00000-memory.dmp

memory/760-6-0x000000001BC80000-0x000000001BD00000-memory.dmp

memory/760-13-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

memory/760-14-0x000000001BC80000-0x000000001BD00000-memory.dmp

memory/760-16-0x000000001BC80000-0x000000001BD00000-memory.dmp

memory/2676-17-0x0000000002B80000-0x0000000002B81000-memory.dmp

memory/760-18-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

memory/2012-19-0x0000000002820000-0x0000000002821000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

148s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD1362.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1032 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2740 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2740 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2740 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1032 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 1032 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 500 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 500 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 500 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 500 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1032 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1476 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1212 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1212 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1212 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1212 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1212 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1212 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1212 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1212 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c 195091702887269.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

Network

Country Destination Domain Proto
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp

Files

memory/1032-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\195091702887269.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 ee6aeb7924fa4cf8ad0e09103a7e973e
SHA1 73f2d8cd420b3f1d554d1c223335cb38b54ddbc8
SHA256 0c2d563aa0e79680cc61fb892cba6e854f5e1208f329c2a9d85209ef84261c98
SHA512 72565da08949667da2a2698491b5cd659a7c6f4e9711c653aa78802c620024ed77f856fd8f20ff258a72df0fa40318129c0cbd83eae30f50549353f4d589ca7b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 495e38cc81c77c33c9c2b73f7af8ca6c
SHA1 a17979ef9ca2e43516ab43982b6effbdfb59bb42
SHA256 0edae61d33645ae2ed1745cd5a64b386d510f6c2694636bb58c04f443a59a729
SHA512 64b0ca5b9500a096baba7a6cb7444f03fef0c51f9a3c09eb3982f07ce6e9525ab4c047a7797ce3678bf5e01ac7cfe81c20ee50cda7b90b948a9ec91364fb9ca1

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 e628d3526b86b090c1ae9abbf93f361e
SHA1 cf5d9031239b2c5e0ed82b2abf31cb9c5f933d6b
SHA256 ed16cd30e0921e5b8861986d67fa0e7759b21a4b60b83aa23c732743d02d9f02
SHA512 be1c183452b689f8d0657c24bb06cae12fc82f8709bf13dd5619a91cc456c82f7c49ed755cdc3105c9819090fe833d135194916d443f881b3612f28d043b045e

C:\Users\Admin\Documents\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 053cde0b182b1456865a6c397dbde381
SHA1 ea09441a05aec5998ee8fcf5ed5c2ed7acd9ea0b
SHA256 e3ca10aa1c506dd92da7c2f5af6ecf5c7ef28bebee5ba9c9e19fe2bdcab50eb1
SHA512 f8003982569d70ece55a6b7ea7e1d9803f0239d4f0b6e843900f49f8368e4575922b2db402595856b206afc8f919e8d40efd5fe9cc57b6103c58e070214b6d10

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 80268ae81a7efeef43051f81f024cf66
SHA1 c70f9474101fd9c8f7f5fd4c656a2f0c1afb55c0
SHA256 1fa4bc0646c7067a1746b6416b0aa6d5dfaf2386548c97196c3d95769adab56d
SHA512 7d2cd33e5581d611d69b36db5da5d75cba54f80a26c000b1edde8dff1ca257523941f5675d1a1f0cd5ac78bc408a73053c691a52f414e17b8407012227e56e30

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 ccbc6709bbe94b36b5f394bcff175bfe
SHA1 c55179f86629699c0f74ffcc030ff60b378bf734
SHA256 b810434481da5b60bf495375c3ff3ca45bb12d27526587fdb89fd25b0d137bf2
SHA512 687be587c175b75275e9eadb5de62f695367ea18261285b59c935ab342a18d78fa38afb4680e0aa62e8751cf72239ed4eb00d9d1cc40722d18e723d2081649e7

Analysis: behavioral7

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

N/A

Files

memory/2156-0-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/2156-1-0x0000000000B70000-0x0000000000BF0000-memory.dmp

memory/2156-2-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/2156-3-0x0000000000B70000-0x0000000000BF0000-memory.dmp

memory/2156-4-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/2156-5-0x0000000000B70000-0x0000000000BF0000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

129s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ace11sutp.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3188 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 3188 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1296 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1296 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3740 wrote to memory of 2748 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3740 wrote to memory of 2748 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3740 wrote to memory of 4424 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3740 wrote to memory of 4424 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1296 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 1296 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

memory/3188-0-0x00000000008F0000-0x0000000000900000-memory.dmp

memory/3188-1-0x00007FFC799B0000-0x00007FFC7A471000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/3188-14-0x00007FFC799B0000-0x00007FFC7A471000-memory.dmp

memory/1296-15-0x00007FFC799B0000-0x00007FFC7A471000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/1296-420-0x00007FFC799B0000-0x00007FFC7A471000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

141s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp

Files

memory/2868-0-0x0000000000660000-0x0000000000661000-memory.dmp

memory/2868-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2868-3-0x0000000000660000-0x0000000000661000-memory.dmp

memory/2868-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2528 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe C:\Windows\system32\WerFault.exe
PID 2528 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe C:\Windows\system32\WerFault.exe
PID 2528 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2528 -s 2372

Network

N/A

Files

memory/2528-0-0x0000000000EF0000-0x0000000001354000-memory.dmp

memory/2528-1-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

memory/2528-2-0x000000001B5E0000-0x000000001B660000-memory.dmp

memory/2528-3-0x000000001B5E0000-0x000000001B660000-memory.dmp

memory/2528-5-0x0000000000530000-0x000000000053A000-memory.dmp

memory/2528-4-0x0000000000530000-0x000000000053A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/2528-16-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-15-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-14-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-13-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-12-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-11-0x000007FEEB260000-0x000007FEEB651000-memory.dmp

memory/2528-17-0x0000000000D80000-0x0000000000D8A000-memory.dmp

memory/2528-18-0x000007FEEAFD0000-0x000007FEEB113000-memory.dmp

memory/2528-19-0x000007FEC9BE0000-0x000007FEC9BEA000-memory.dmp

memory/2528-20-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

memory/2528-21-0x0000000000B50000-0x0000000000B51000-memory.dmp

memory/2528-23-0x000000001B5E0000-0x000000001B660000-memory.dmp

memory/2528-24-0x000000001B5E0000-0x000000001B660000-memory.dmp

memory/2528-26-0x0000000000530000-0x000000000053A000-memory.dmp

memory/2528-27-0x000007FEEB260000-0x000007FEEB651000-memory.dmp

memory/2528-31-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-30-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-29-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-28-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

memory/2528-32-0x0000000000D80000-0x0000000000D8A000-memory.dmp

memory/2528-33-0x000007FEEAFD0000-0x000007FEEB113000-memory.dmp

memory/2528-34-0x000007FEC9BE0000-0x000007FEC9BEA000-memory.dmp

memory/2528-35-0x000007FEEB260000-0x000007FEEB651000-memory.dmp

memory/2528-36-0x0000000000D80000-0x0000000000D85000-memory.dmp

memory/2528-37-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

141s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

N/A

Files

memory/1900-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1900-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/1900-3-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1900-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:16

Platform

win7-20231129-en

Max time kernel

119s

Max time network

120s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\LICENSE

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\LICENSE

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:15

Platform

win10v2004-20231215-en

Max time kernel

55s

Max time network

76s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{D87259C3-DC1F-47F8-A830-0DBE446D2C4F} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3520 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3520 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3520 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4556 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4556 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4556 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4556 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4556 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4556 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4556 wrote to memory of 896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4556 wrote to memory of 896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4556 wrote to memory of 896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4556 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4556 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4556 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3941055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 224.162.46.104.in-addr.arpa udp

Files

memory/3520-0-0x0000000074D60000-0x0000000075510000-memory.dmp

memory/3520-1-0x0000000000990000-0x000000000103E000-memory.dmp

memory/3520-2-0x0000000005B90000-0x0000000005BA0000-memory.dmp

memory/3520-3-0x0000000006150000-0x00000000066F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/3520-11-0x0000000005B90000-0x0000000005BA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3520-25-0x0000000009850000-0x0000000009888000-memory.dmp

memory/3520-26-0x00000000095F0000-0x00000000095FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/3520-163-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-164-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-170-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-168-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-171-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-176-0x0000000074D60000-0x0000000075510000-memory.dmp

memory/3520-215-0x000000000CBF0000-0x000000000CC00000-memory.dmp

memory/3520-225-0x000000000CBF0000-0x000000000CC00000-memory.dmp

memory/3520-228-0x000000000CBF0000-0x000000000CC00000-memory.dmp

memory/3520-230-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-229-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-232-0x000000000CBF0000-0x000000000CC00000-memory.dmp

memory/3520-231-0x0000000009C50000-0x0000000009C60000-memory.dmp

memory/3520-233-0x0000000005B90000-0x0000000005BA0000-memory.dmp

memory/3520-234-0x000000000CBF0000-0x000000000CC00000-memory.dmp

memory/3520-224-0x000000000CBF0000-0x000000000CC00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 d634566fab4e46099eec172f2a8c07c7
SHA1 05cfda5369188ef88925af20d4718efca8523450
SHA256 1acf5be099f558de9eb2f9fec96c3b3a7975dc1253cc7145aa5e96423446a171
SHA512 ed45a3a2cfce37fdf3e05899820152d31ad698b88a0abc408a5d974b599c78ce9c78a6c6f8dea5b089ae1af05f8c071b31c94b1469ee9eded5ff7c37ed9879c8

memory/3520-865-0x0000000005B90000-0x0000000005BA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/3520-877-0x0000000074D60000-0x0000000075510000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

93s

Max time network

149s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\LICENSE

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\LICENSE

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 23.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:14

Platform

win7-20231215-en

Max time kernel

7s

Max time network

8s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2300 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2300 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2300 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2300 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2300-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/2324-13-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

memory/2300-10-0x000000002AA00000-0x000000002AA24000-memory.dmp

memory/2300-4-0x0000000000220000-0x0000000000244000-memory.dmp

memory/2760-14-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/2548-15-0x0000000002820000-0x0000000002821000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp" /SL5="$D006A,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/2476-1-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-F8N4F.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/1268-7-0x00000000007B0000-0x00000000007B1000-memory.dmp

memory/2476-13-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1268-14-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/1268-17-0x00000000007B0000-0x00000000007B1000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:14

Platform

win10v2004-20231215-en

Max time kernel

8s

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4480 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4480 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3984855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/4480-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/4480-5-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

Analysis: behavioral21

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

122s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\README.md

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\md_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\md_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.md\ = "md_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\md_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\md_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.md C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\md_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2800 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 2800 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 2800 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 2748 wrote to memory of 2784 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2748 wrote to memory of 2784 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2748 wrote to memory of 2784 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2748 wrote to memory of 2784 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-database-main\README.md

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Malware-database-main\README.md

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Malware-database-main\README.md"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 c70226db36a52df8a0cece2d48a146e7
SHA1 b4ef6a2f0b2c551fdd7a74080d6f30265e2cf156
SHA256 3be47dbf49f9c8a6445d1f5cd9c6146e25e7ccb576c4956c4d43174fcb9fffd3
SHA512 55d8107e844c17e822984dbcf87d79c00617b15ea11f556249d4f665aa4793186b4a29e413a216c84a48b5cedb1fd89bccd8fa2006bdf337c625fac816fa419f

Analysis: behavioral4

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

144s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{855E9596-72D0-460C-88E1-A43083B67268} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x498 0x304

Network

Country Destination Domain Proto
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/1380-0-0x0000000000800000-0x0000000000C64000-memory.dmp

memory/1380-1-0x00007FFD78C90000-0x00007FFD79751000-memory.dmp

memory/1380-2-0x000000001D200000-0x000000001D210000-memory.dmp

memory/1380-3-0x000000001D200000-0x000000001D210000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/1380-14-0x000000001D200000-0x000000001D210000-memory.dmp

memory/1380-16-0x000000001D8A0000-0x000000001D8A8000-memory.dmp

memory/1380-17-0x000000001D200000-0x000000001D210000-memory.dmp

memory/1380-18-0x000000001D950000-0x000000001D988000-memory.dmp

memory/1380-19-0x000000001D920000-0x000000001D92E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 9dedc5a4729f1b5e224e057dd630469c
SHA1 0b4a619e6db183af3b0d8834755ee7b13a87ed85
SHA256 7381da09878e681d64cad2696b74a3d9afea630afc7507dffd3e763ac71068dd
SHA512 892b672a6b9e0873843c4e44b269bfa59c42c2669c87241a3416ea1eed70cb682a1c95df91b29104eb857c6396bb92359f9972fcc4786996a08a75eb005566ab

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 cb1a79de9452e22b1c26ddc054f45141
SHA1 84b0f9ca5357ada1b2b9301b870c5ca21398f996
SHA256 c0df0b837ca2976b9a256d34b1e3baf7befee92caedbfecc8c275a1cc6e4fcf3
SHA512 78737baf62c2c226f39cfe78d459eb9ca2b0c83320e3990fe72db15d82bd052d6f5e34e8e017bd37a0a6f3213e59387e7e7bb2465eee8f7fecb3604eef217dab

memory/1380-37-0x00007FFD78C90000-0x00007FFD79751000-memory.dmp

memory/1380-38-0x000000001D200000-0x000000001D210000-memory.dmp

memory/1380-39-0x000000001D200000-0x000000001D210000-memory.dmp

memory/1380-40-0x000000001D200000-0x000000001D210000-memory.dmp

memory/1380-54-0x00007FFD78C90000-0x00007FFD79751000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

116s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 6.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/4316-1-0x00007FFFAAE90000-0x00007FFFAB831000-memory.dmp

memory/4316-0-0x000000001B800000-0x000000001B8A6000-memory.dmp

memory/4316-2-0x000000001BD80000-0x000000001C24E000-memory.dmp

memory/4316-3-0x000000001C3B0000-0x000000001C44C000-memory.dmp

memory/4316-4-0x00007FFFAAE90000-0x00007FFFAB831000-memory.dmp

memory/4316-5-0x00000000010F0000-0x0000000001100000-memory.dmp

memory/4316-7-0x000000001C510000-0x000000001C55C000-memory.dmp

memory/4316-6-0x000000001C250000-0x000000001C258000-memory.dmp

memory/4316-8-0x00000000010F0000-0x0000000001100000-memory.dmp

memory/4316-9-0x00007FFFAAE90000-0x00007FFFAB831000-memory.dmp

memory/4316-10-0x00007FFFAAE90000-0x00007FFFAB831000-memory.dmp

memory/4316-11-0x00000000010F0000-0x0000000001100000-memory.dmp

memory/4316-12-0x00000000010F0000-0x0000000001100000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win7-20231215-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3601492379-692465709-652514833-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ez0ji7juq.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2420 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2420 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2420 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2668 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2668 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2668 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2888 wrote to memory of 2928 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2928 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2928 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2868 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2868 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2868 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2668 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2668 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

N/A

Files

memory/2420-0-0x0000000001290000-0x00000000012A0000-memory.dmp

memory/2420-1-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/2668-7-0x0000000000170000-0x0000000000180000-memory.dmp

memory/2668-9-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

memory/2420-8-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

memory/2668-14-0x000000001AC10000-0x000000001AC90000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/2668-455-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

memory/2668-456-0x000000001AC10000-0x000000001AC90000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2023-12-18 08:13

Reported

2023-12-18 08:17

Platform

win10v2004-20231215-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

N/A