Malware Analysis Report

2024-08-06 15:41

Sample ID 240213-pa6qtahc7y
Target 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
SHA256 1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
Tags
evasion persistence ransomware chaos spyware stealer bootkit wannacry worm trojan aspackv2 discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518

Threat Level: Known bad

The file 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip was found to be: Known bad.

Malicious Activity Summary

evasion persistence ransomware chaos spyware stealer bootkit wannacry worm trojan aspackv2 discovery

Chaos family

Chaos

Modifies Windows Defender Real-time Protection settings

UAC bypass

Wannacry

Chaos Ransomware

Modifies boot configuration data using bcdedit

Deletes shadow copies

Disables use of System Restore points

Disables RegEdit via registry modification

Sets file execution options in registry

Disables Task Manager via registry modification

Modifies Windows Firewall

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Drops startup file

Loads dropped DLL

ASPack v2.12-2.42

Modifies WinLogon

Checks installed software on the system

Drops desktop.ini file(s)

Checks whether UAC is enabled

Enumerates connected drives

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Sets desktop wallpaper using registry

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Enumerates system info in registry

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Opens file in notepad (likely ransom note)

Suspicious use of SetWindowsHookEx

System policy modification

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Pre-OS Boot
T1542
Bootkit
T1542.003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Pre-OS Boot
T1542
Bootkit
T1542.003
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Disable or Modify System Firewall
T1562.004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Indicator Removal
T1070
File Deletion
T1070.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Defacement
T1491
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-13 12:08

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:09

Platform

win10v2004-20231215-en

Max time kernel

32s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983843758-932321429-1636175382-1000\{D3178A21-FAE5-4D7C-AC7B-887FFAA0D9C9} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1504 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 388 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 388 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 388 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 388 wrote to memory of 3236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 388 wrote to memory of 3236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 388 wrote to memory of 3236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 388 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 388 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 388 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 388 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 388 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 388 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa399d855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 77.239.69.13.in-addr.arpa udp

Files

memory/1504-0-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/1504-1-0x0000000000F00000-0x00000000015AE000-memory.dmp

memory/1504-2-0x0000000005E00000-0x0000000005E10000-memory.dmp

memory/1504-3-0x0000000006690000-0x0000000006C34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/1504-11-0x0000000005E00000-0x0000000005E10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/1504-25-0x000000000C020000-0x000000000C058000-memory.dmp

memory/1504-26-0x000000000BC50000-0x000000000BC5E000-memory.dmp

memory/1504-29-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-31-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-32-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-33-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-35-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-36-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-37-0x000000000C130000-0x000000000C140000-memory.dmp

memory/1504-39-0x000000000C130000-0x000000000C140000-memory.dmp

memory/1504-42-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/1504-41-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-43-0x000000000C130000-0x000000000C140000-memory.dmp

memory/1504-44-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-40-0x000000000C160000-0x000000000C170000-memory.dmp

memory/1504-45-0x000000000C130000-0x000000000C140000-memory.dmp

memory/1504-46-0x0000000005E00000-0x0000000005E10000-memory.dmp

memory/1504-47-0x000000000C130000-0x000000000C140000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 0f89d7861fd2dc2be13563c54e5fe6eb
SHA1 04ee8642ebd9ae9c3ce5f5eaa7b4f02fb6f543fe
SHA256 50d46cc9a9e63eabb1e5919b783a6c1aee0da46bcf8a4f97dfc2a6b525697d5c
SHA512 121e67ee2115fcd57a908138d923b910b22b671be1e94164927c9a60a6b33bd1b3eb750d114b1caba0c198b5cab8ff13c367405e3ed53fae0747b692ef8c58e8

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/1504-146-0x0000000005E00000-0x0000000005E10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/1504-870-0x0000000074F40000-0x00000000756F0000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231215-en

Max time kernel

141s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 17.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

memory/2304-0-0x000000001B5F0000-0x000000001B696000-memory.dmp

memory/2304-1-0x00007FF9A7600000-0x00007FF9A7FA1000-memory.dmp

memory/2304-2-0x000000001BB70000-0x000000001C03E000-memory.dmp

memory/2304-3-0x00007FF9A7600000-0x00007FF9A7FA1000-memory.dmp

memory/2304-4-0x0000000000EF0000-0x0000000000F00000-memory.dmp

memory/2304-5-0x000000001C1A0000-0x000000001C23C000-memory.dmp

memory/2304-6-0x000000001C040000-0x000000001C048000-memory.dmp

memory/2304-7-0x000000001C300000-0x000000001C34C000-memory.dmp

memory/2304-8-0x0000000000EF0000-0x0000000000F00000-memory.dmp

memory/2304-9-0x00007FF9A7600000-0x00007FF9A7FA1000-memory.dmp

memory/2304-10-0x00007FF9A7600000-0x00007FF9A7FA1000-memory.dmp

memory/2304-11-0x0000000000EF0000-0x0000000000F00000-memory.dmp

memory/2304-12-0x0000000000EF0000-0x0000000000F00000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231215-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3791175113-1062217823-1177695025-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oib7003y2.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4180 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 4180 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1872 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1872 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1180 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1180 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1180 wrote to memory of 1196 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1180 wrote to memory of 1196 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1872 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 1872 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 6.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4180-0-0x0000000000F70000-0x0000000000F80000-memory.dmp

memory/4180-1-0x00007FFB6ADC0000-0x00007FFB6B881000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/4180-14-0x00007FFB6ADC0000-0x00007FFB6B881000-memory.dmp

memory/1872-15-0x00007FFB6ADC0000-0x00007FFB6B881000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/1872-488-0x00007FFB6ADC0000-0x00007FFB6B881000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231215-en

Max time kernel

141s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/3048-0-0x0000000002100000-0x0000000002101000-memory.dmp

memory/3048-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/3048-3-0x0000000002100000-0x0000000002101000-memory.dmp

memory/3048-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:09

Platform

win10v2004-20231215-en

Max time kernel

7s

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "161" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4784 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4784 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4784 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39f9855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 120.150.79.40.in-addr.arpa udp

Files

memory/4784-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

memory/4784-6-0x000000002AA00000-0x000000002AA24000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

148s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA142.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 660 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2884 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2884 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2884 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 660 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 660 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 660 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 660 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 792 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 792 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 792 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 792 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c 1261707826135.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

Network

Country Destination Domain Proto
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp

Files

memory/660-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\1261707826135.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 a0ccb8fccc3eff1bd74717405c8df09a
SHA1 f45e167b9b36d8fccfaeedd07ea218d78ee7ec0f
SHA256 45a31c6d823e7f3197b8a1dc9f3d908491b6220a918ae58872f2fd36d8275197
SHA512 94c6c709063f904e83b854c4d22dd2b185c602308ef134a96402f18c566f0aa2a932cd3615b22e8668239b093664836d198ce74544cc7400565fe85fe2916eef

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 29cc859f0854a992695d1e21088ae771
SHA1 824e381e8606e0306f0f5f2bf25487ecff7b531b
SHA256 9fdb656625b527bb237ec5955beb9e8e2414d5a0b427146990652d7f84c74835
SHA512 5fa546bfa707beb5257bf403279bad8c5d802cb11e42104eaa5a615b3f3851360231ce8dbc5d8ffe314aa47d7e78e0f9e632eff6b41b23afa7302f53e7f1614b

C:\Users\Admin\Documents\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 07bfc895f26c73b9c7f2644fd50bbf2c
SHA1 ab719867ed7b85234e383903a113f00633597950
SHA256 e3dec482dfeb7850e79e686d67e034587fb86982e1cdf20f90861f8e0ccf9740
SHA512 f777ade1bdb07fefb153c1831e898966849744774f08a6aed1fb75e9a3b40ca852d8f3cb3259ddc07e018371b8218647a360f5012f349adb5f196520b6347c0b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 2f04f3836a5680a01911def7c9f30fc9
SHA1 e0a26ca2bf0bbffcc1e22ac8d08eb2409f786166
SHA256 de2d2684702afefd32f769497e8bc2a8e2fc45b9834d9d1152e3bc3a19527ff3
SHA512 cbb4f7b72eb517812535bbb3e5c453628e6055a931e669ebcef6163fa54854dd23034f248bc6a2073b716fcc6de06ea42ffb606da5123d7a1f6a1a759071ee39

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Analysis: behavioral3

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Network

N/A

Files

memory/616-0-0x0000000000A40000-0x0000000000EA4000-memory.dmp

memory/616-1-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

memory/616-2-0x000000001B3C0000-0x000000001B440000-memory.dmp

memory/616-3-0x000000001B3C0000-0x000000001B440000-memory.dmp

memory/616-5-0x0000000000560000-0x000000000056A000-memory.dmp

memory/616-4-0x0000000000560000-0x000000000056A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 2c110828dabd0e465b1c9a607f5f7779
SHA1 e0c0bf083ea3052ca05bdbdc1f54dd8d743df4aa
SHA256 2c9e9e98a6fc689b5930b0dadebe1a614079c1ff61af5671a05fe50e243aee68
SHA512 e37a792ff09289808e79f3f8d8777a35cddcec1782a7ef0b1c1c351ae8f3e3a8b8a3dce84e41727db802224aae54b4950146a0ef54f4b2518b7a1030e28f1c45

memory/616-11-0x000007FEEEC10000-0x000007FEEF001000-memory.dmp

memory/616-15-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-12-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-16-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-18-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-30-0x000007FEEE980000-0x000007FEEEAC3000-memory.dmp

memory/616-31-0x000000001AF60000-0x000000001AF6A000-memory.dmp

memory/616-32-0x000007FE97A30000-0x000007FE97A3A000-memory.dmp

memory/616-33-0x000000001AA00000-0x000000001AA01000-memory.dmp

memory/616-35-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

memory/616-36-0x000000001B3C0000-0x000000001B440000-memory.dmp

memory/616-37-0x000000001B3C0000-0x000000001B440000-memory.dmp

memory/616-38-0x0000000000560000-0x000000000056A000-memory.dmp

memory/616-39-0x0000000000560000-0x000000000056A000-memory.dmp

memory/616-40-0x000007FEEEC10000-0x000007FEEF001000-memory.dmp

memory/616-42-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-45-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-44-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-43-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-46-0x000000001AA90000-0x000000001AA9A000-memory.dmp

memory/616-47-0x000000001AF60000-0x000000001AF6A000-memory.dmp

memory/616-48-0x000007FEEE980000-0x000007FEEEAC3000-memory.dmp

memory/616-49-0x000000001AF60000-0x000000001AF6A000-memory.dmp

memory/616-50-0x000007FE97A30000-0x000007FE97A3A000-memory.dmp

memory/616-54-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

memory/616-55-0x0000000000560000-0x0000000000562000-memory.dmp

memory/616-56-0x000007FEEEC10000-0x000007FEEF001000-memory.dmp

memory/616-57-0x000007FEEE980000-0x000007FEEEAC3000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231222-en

Max time kernel

141s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/1852-0-0x00000000006D0000-0x00000000006D1000-memory.dmp

memory/1852-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/1852-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231215-en

Max time kernel

142s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

memory/2384-0-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/2384-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-2-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-3-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/2384-4-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-5-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-7-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-9-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-11-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-12-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-13-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-14-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2384-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231129-en

Max time kernel

140s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

N/A

Files

memory/2216-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2216-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2216-3-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2216-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:09

Platform

win7-20231215-en

Max time kernel

26s

Max time network

30s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 1244 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 1244 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 1244 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 1244 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 1244 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 1244 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/1244-0-0x0000000000FC0000-0x0000000001A5C000-memory.dmp

memory/1244-1-0x000007FEF6040000-0x000007FEF6A2C000-memory.dmp

memory/1244-2-0x000000001BB50000-0x000000001CB66000-memory.dmp

memory/1244-3-0x0000000000150000-0x0000000000156000-memory.dmp

memory/1244-4-0x00000000006A0000-0x0000000000720000-memory.dmp

memory/1244-5-0x00000000006A0000-0x0000000000720000-memory.dmp

memory/1244-6-0x00000000006A0000-0x0000000000720000-memory.dmp

memory/1244-13-0x000007FEF6040000-0x000007FEF6A2C000-memory.dmp

memory/476-15-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/1244-16-0x000007FEF6040000-0x000007FEF6A2C000-memory.dmp

memory/2620-17-0x00000000027A0000-0x00000000027A1000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

141s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

N/A

Files

memory/2412-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2412-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2412-3-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2412-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2412-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:10

Platform

win10v2004-20231215-en

Max time kernel

44s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "85" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4448 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4448 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4448 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4448 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4448 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4448 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4448 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 4448 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 4448 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 4448 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3983055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

memory/4448-0-0x000001863CA60000-0x000001863D4FC000-memory.dmp

memory/4448-1-0x00007FF8BCD70000-0x00007FF8BD831000-memory.dmp

memory/4448-2-0x0000018657970000-0x0000018658986000-memory.dmp

memory/4448-3-0x000001863D8A0000-0x000001863D8A6000-memory.dmp

memory/4448-4-0x000001863F090000-0x000001863F0A0000-memory.dmp

memory/4448-5-0x000001863F090000-0x000001863F0A0000-memory.dmp

memory/4448-12-0x00007FF8BCD70000-0x00007FF8BD831000-memory.dmp

memory/4448-14-0x000001863F090000-0x000001863F0A0000-memory.dmp

memory/4448-15-0x000001863F090000-0x000001863F0A0000-memory.dmp

memory/4448-16-0x00007FF8BCD70000-0x00007FF8BD831000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231222-en

Max time kernel

145s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5A1A.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5A31.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2056 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 4236 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4236 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4236 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2056 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2336 wrote to memory of 712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2336 wrote to memory of 712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2336 wrote to memory of 712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2056 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 712 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 712 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 712 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 4836 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4836 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4836 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 201121707826132.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 85.177.190.20.in-addr.arpa udp

Files

memory/2056-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\u.wry

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\201121707826132.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 b729a46991214e3985c176d4a06a0928
SHA1 b2a2b04906270a60fd2e56e3e038bfc5923479d5
SHA256 d1999faad51a17a684ac2f4222255114863ca5230011c6a6716bd90c64ccf577
SHA512 1ccd678b925d5088e0ac6b4ed88c0950c5e4bb2f1d9980fd722382d25819efaa64fe863d445f269cd2e944d75ea14e7e68b24fb9b753816deb430d35ca20862c

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 f302583027f02d8e8dd78c715acd5109
SHA1 691f0b1032d91f91b3bfc817178d4bad21e00167
SHA256 28e69f63b908045d58f50b4a893558da63d7b771bbdd5a5cf1840e9b069335b8
SHA512 0b2b90db891dc1025f5526077f575f2806fcd225ec7ffb3022276fcd88dfbbf5aff4af7f74e035b52006a7bbdb704533e87e33cb2b774046f1acdeb7fb8d8e55

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 6e99784c179a52b2d0f7c9b1c6122ba1
SHA1 a255c643cee559bc48b20fdaae3e825677ad2197
SHA256 cd2ee3d33b6b392208f3e85358ce90c1a417a18692631232156655611fc573d0
SHA512 95dad90e6685cfa2cfeff392b67bfc07222f58ef5c7d6ee920338c55fe96a9cc8839c7ac3ec78d27fd2c9776972a3c370657476a1b1014e210ee714f83b92c9e

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 8fce820475fa35dbeae124fe027fd1a8
SHA1 488c629873616f500a7b4baad2f89f6663f1973a
SHA256 08fb4dddf967db92d6948e5d87b962d4bd1a0688ee9be3bb930d1115440bf35b
SHA512 418312c96fe374f00a0750aacbfb6e5c594c3d3f7f21e9c17c7767ed32e8a464d2e36634de8c2409ccab2dbd5adec5309e2b22923056c3090bcbcc1d2c4765bc

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 db9948dcf1927a1c78479a20d5a4fa76
SHA1 eadf94a64ad27074a379ba0976b0f5346cce4726
SHA256 0142230245c0034fad9916465f532e370804e02f056b9569539ff11a3de9b763
SHA512 c3f34d17b943283e493665680b3599ab898a586bd98deef49543fb02530d6eca561c3f137a1a4ca4049bb909a4e50ab0c46de23e58e143d589c105a6ad2fc7b1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

MD5 391dbcfd4a3ac2930dde8195498405d7
SHA1 69be13cdff4139c830e27ce1902eb30a0e06813a
SHA256 5d62fc5e32c3b2c1cec041de27b83c67f6e09765f18f09ec216dff6dd5f1e253
SHA512 79ad2d069667bfdbd9e91764d948aa788dc32775aa58618d7a5bae82d5c5904ee3160bc90f78bfa49bfc1829b6abad92b3fb41bcafff8c73d2e627785857c9e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 c04cbe41be05b451bb105716ab5f722b
SHA1 76549ce024a730266168acb2c4a43496c632875c
SHA256 61a1747b5a24782c7f18a592c45bf9e13e40ceddc3f0c527166d9e45aed5b0a8
SHA512 8ab545c8b43003fd31401c24e49264e011d61089c642593406d941e47ba3b6025fdb0e941f9222d50e7434479d22767a99f2e211b331a7b46172f64e1704568a

Analysis: behavioral23

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Butterfly on Desktop\is-K7RUM.tmp C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-MGS4B.tmp C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-OD626.tmp C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp
PID 3032 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp" /SL5="$400F2,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

N/A

Files

memory/3032-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3032-2-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-4D84K.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/2516-8-0x0000000000240000-0x0000000000241000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-S1B2I.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/3032-16-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2516-17-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2516-20-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2516-34-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Program Files (x86)\Butterfly on Desktop\is-MGS4B.tmp

MD5 81aab57e0ef37ddff02d0106ced6b91e
SHA1 6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256 a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512 a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

memory/2516-49-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/3032-50-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oj9a9apov.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1280 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1280 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1280 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2440 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2440 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2440 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2948 wrote to memory of 2960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2948 wrote to memory of 2960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2948 wrote to memory of 2960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2948 wrote to memory of 2912 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2948 wrote to memory of 2912 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2948 wrote to memory of 2912 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2440 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2440 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2440 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

N/A

Files

memory/1280-0-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

memory/1280-1-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/2440-7-0x0000000000D40000-0x0000000000D50000-memory.dmp

memory/1280-8-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

memory/2440-9-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

memory/2440-11-0x000000001AE60000-0x000000001AEE0000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/2440-455-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

memory/2440-456-0x000000001AE60000-0x000000001AEE0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:09

Platform

win7-20231215-en

Max time kernel

11s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2648 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2760 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2760 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2760 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2760 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2760 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2648-0-0x0000000074550000-0x0000000074C3E000-memory.dmp

memory/2648-1-0x00000000008F0000-0x0000000000F9E000-memory.dmp

memory/2648-2-0x0000000004D20000-0x0000000004D60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2648-15-0x0000000004D20000-0x0000000004D60000-memory.dmp

memory/2648-16-0x0000000000600000-0x000000000060A000-memory.dmp

memory/2648-17-0x0000000000600000-0x000000000060A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/2648-28-0x0000000004850000-0x000000000485A000-memory.dmp

memory/2648-27-0x0000000004850000-0x000000000485A000-memory.dmp

memory/2648-26-0x000000006B6B0000-0x000000006B9C2000-memory.dmp

memory/2648-29-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

memory/2648-30-0x0000000004CB0000-0x0000000004CBA000-memory.dmp

memory/2648-31-0x00000000008E0000-0x00000000008E1000-memory.dmp

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2648-353-0x0000000074550000-0x0000000074C3E000-memory.dmp

memory/2648-838-0x0000000004D20000-0x0000000004D60000-memory.dmp

memory/1864-839-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/2648-843-0x0000000004CB0000-0x0000000004CB5000-memory.dmp

memory/2648-842-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

memory/2648-841-0x000000006B6B0000-0x000000006B9C2000-memory.dmp

memory/2648-840-0x0000000074550000-0x0000000074C3E000-memory.dmp

memory/2272-844-0x0000000002760000-0x0000000002761000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

141s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

N/A

Files

memory/2184-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2184-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/2184-3-0x0000000000220000-0x0000000000221000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231222-en

Max time kernel

147s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Butterfly on Desktop\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-015M0.tmp C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-QRO5O.tmp C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-S7VRO.tmp C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
File created C:\Program Files (x86)\Butterfly on Desktop\is-HP6E0.tmp C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
File opened for modification C:\Program Files (x86)\Butterfly on Desktop\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2928 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp
PID 2928 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp
PID 2928 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp
PID 4988 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 4988 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 4988 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
PID 4988 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 2096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 2096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3348 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp" /SL5="$6006A,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0x44,0x114,0x7ffe5b0346f8,0x7ffe5b034708,0x7ffe5b034718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12807144930957365702,5545969871727516137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 85.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 freedesktopsoft.com udp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
DE 78.46.117.95:80 freedesktopsoft.com tcp
GB 142.250.178.14:80 www.google-analytics.com tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.147.23:80 connect.facebook.net tcp
US 8.8.8.8:53 95.117.46.78.in-addr.arpa udp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 216.58.212.226:443 googleads.g.doubleclick.net tcp
GB 216.58.212.226:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 226.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
GB 216.58.212.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.238:443 fundingchoicesmessages.google.com tcp
GB 172.217.16.238:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 225.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com udp
GB 142.250.180.3:80 fonts.gstatic.com tcp
GB 142.250.180.3:80 fonts.gstatic.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 216.58.212.225:443 tpc.googlesyndication.com udp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

memory/2928-0-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-NE61N.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/4988-6-0x00000000006A0000-0x00000000006A1000-memory.dmp

memory/2928-12-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4988-13-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/4988-16-0x00000000006A0000-0x00000000006A1000-memory.dmp

memory/4988-32-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

MD5 81aab57e0ef37ddff02d0106ced6b91e
SHA1 6e3895b350ef1545902bd23e7162dfce4c64e029
SHA256 a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512 a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

memory/3532-53-0x0000000002370000-0x0000000002371000-memory.dmp

memory/4988-57-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2928-58-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3e71d66ce903fcba6050e4b99b624fa7
SHA1 139d274762405b422eab698da8cc85f405922de5
SHA256 53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
SHA512 17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

\??\pipe\LOCAL\crashpad_3348_QAEVVZRSMTEMVTUI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 11aef1dd4a471d875e425ba6100ae2d2
SHA1 990347cc43fd3afb346c816cc42721de57f750a1
SHA256 8907650ae6bf40f1356d41f4633f129030c369d34d0a148fd8ccf6d4af897214
SHA512 369b2249ef876236fa4a1f80098ce642ecf4dfef6835023fafe6721d02b1276ae700f02f2514e11401103881eaaa40379c32ba5d743a4e52265f14c7a13eac74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3532-185-0x0000000000400000-0x000000000070B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d48b88722a3c241636f2cec6550eb19a
SHA1 df4c9eb33ced2722b7300608061e4a7e14b130b2
SHA256 032294d6a1bfdb0b381d037bdae71049d05c094b21176f0b646730bce7cf96b6
SHA512 0c8aa1d101a40ddd681664e723e6e4e22333aaec952cf1ac5b787cd6aee225516a461c440a39b5d5e3caf6490ca1c519dce4b4ce65151e36adfabbf07b95ead2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2eeb735470ad4f74fa58f6f6da4352f4
SHA1 57580e1e6af4a842b3720bd6ce03e2681b74522d
SHA256 f62edf2a4b056224ce32e43ae4eac87d4f3d9058280157b4bdc94ace44abc880
SHA512 91019e01082aa438b6b060e4cec682e6fb772086d0c930f327c4484d3d33d048a80a519d9bfd2d55240401e1b7603ed50c2ea5b0660b3338aee2d4427e7f4453

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 1b1b142e24215f033793d1311e24f6e6
SHA1 74e23cffbf03f3f0c430e6f4481e740c55a48587
SHA256 3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
SHA512 a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

memory/3532-211-0x0000000000400000-0x000000000070B000-memory.dmp

memory/3532-221-0x0000000002370000-0x0000000002371000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b2427638595cf3b9d9e92320d356ff32
SHA1 cf9515818fc7058a1496c09490a7db994556b538
SHA256 9be22ed126eaa6601f13a43b2ff9f9224a5bc301a407b915e7dccb85b047d911
SHA512 be8c91abeb972b8ec326be455193d0b1f7e96f9744b85e696dd526212b5d2bb582d11c3d8c38792df39a09f37f79d90fa0375a51df3aaf88200515134acd84b9

memory/3532-227-0x0000000000400000-0x000000000070B000-memory.dmp

memory/3532-228-0x0000000000400000-0x000000000070B000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231222-en

Max time kernel

88s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/2316-0-0x0000000000210000-0x0000000000674000-memory.dmp

memory/2316-1-0x00007FFC16F50000-0x00007FFC17A11000-memory.dmp

memory/2316-2-0x000000001CB00000-0x000000001CB10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/2316-13-0x000000001CB00000-0x000000001CB10000-memory.dmp

memory/2316-15-0x0000000022640000-0x0000000022648000-memory.dmp

memory/2316-16-0x00007FFC16F50000-0x00007FFC17A11000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win7-20231215-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

N/A

Files

memory/2164-0-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

memory/2164-1-0x0000000000B50000-0x0000000000BD0000-memory.dmp

memory/2164-2-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

memory/2164-3-0x0000000000B50000-0x0000000000BD0000-memory.dmp

memory/2164-5-0x0000000000B50000-0x0000000000BD0000-memory.dmp

memory/2164-4-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

memory/2164-6-0x0000000000B50000-0x0000000000BD0000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:11

Platform

win10v2004-20231222-en

Max time kernel

144s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 105.246.116.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-02-13 12:08

Reported

2024-02-13 12:09

Platform

win7-20231215-en

Max time kernel

5s

Max time network

9s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2072 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2072 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2072 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2072-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

memory/2072-10-0x000000002AA00000-0x000000002AA24000-memory.dmp

memory/2072-12-0x0000000000220000-0x0000000000244000-memory.dmp

memory/2752-13-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/2632-14-0x00000000026E0000-0x00000000026E1000-memory.dmp