Malware Analysis Report

2024-08-06 15:35

Sample ID 240213-pcwzdshd2w
Target 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
SHA256 1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
Tags
wannacry persistence ransomware spyware stealer worm aspackv2 chaos evasion bootkit trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518

Threat Level: Known bad

The file 82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip was found to be: Known bad.

Malicious Activity Summary

wannacry persistence ransomware spyware stealer worm aspackv2 chaos evasion bootkit trojan

Modifies Windows Defender Real-time Protection settings

Wannacry

Chaos

Chaos Ransomware

Chaos family

UAC bypass

Modifies boot configuration data using bcdedit

Deletes shadow copies

Disables Task Manager via registry modification

Modifies Windows Firewall

Disables RegEdit via registry modification

Sets file execution options in registry

Disables use of System Restore points

Loads dropped DLL

Reads user/profile data of web browsers

ASPack v2.12-2.42

Executes dropped EXE

Checks computer location settings

Drops startup file

Modifies WinLogon

Adds Run key to start application

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Checks whether UAC is enabled

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops autorun.inf file

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Interacts with shadow copies

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: AddClipboardFormatListener

Opens file in notepad (likely ransom note)

Suspicious use of AdjustPrivilegeToken

System policy modification

Kills process with taskkill

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Pre-OS Boot
T1542
Bootkit
T1542.003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Pre-OS Boot
T1542
Bootkit
T1542.003
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Disable or Modify System Firewall
T1562.004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Defacement
T1491
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-13 12:11

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Network

N/A

Files

memory/2060-1-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2060-0-0x00000000002B0000-0x0000000000714000-memory.dmp

memory/2060-2-0x000000001B590000-0x000000001B610000-memory.dmp

memory/2060-4-0x0000000002360000-0x000000000236A000-memory.dmp

memory/2060-3-0x000000001B590000-0x000000001B610000-memory.dmp

memory/2060-5-0x0000000002360000-0x000000000236A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/2060-14-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-12-0x000007FEEB710000-0x000007FEEBB01000-memory.dmp

memory/2060-15-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-16-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-20-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-18-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-31-0x00000000024B0000-0x00000000024BA000-memory.dmp

memory/2060-32-0x000007FEEB480000-0x000007FEEB5C3000-memory.dmp

memory/2060-33-0x000007FF18A10000-0x000007FF18A1A000-memory.dmp

memory/2060-34-0x00000000023F0000-0x00000000023F1000-memory.dmp

memory/2060-36-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2060-38-0x000000001B590000-0x000000001B610000-memory.dmp

memory/2060-39-0x000000001B590000-0x000000001B610000-memory.dmp

memory/2060-40-0x0000000002360000-0x000000000236A000-memory.dmp

memory/2060-41-0x0000000002360000-0x000000000236A000-memory.dmp

memory/2060-42-0x000007FEEB710000-0x000007FEEBB01000-memory.dmp

memory/2060-47-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-46-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-45-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-44-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-43-0x0000000002410000-0x000000000241A000-memory.dmp

memory/2060-48-0x00000000024B0000-0x00000000024BA000-memory.dmp

memory/2060-49-0x000007FEEB480000-0x000007FEEB5C3000-memory.dmp

memory/2060-50-0x000007FF18A10000-0x000007FF18A1A000-memory.dmp

memory/2060-51-0x00000000024B0000-0x00000000024BA000-memory.dmp

memory/2060-55-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2060-56-0x000007FEEB710000-0x000007FEEBB01000-memory.dmp

memory/2060-57-0x000007FEEB480000-0x000007FEEB5C3000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231215-en

Max time kernel

140s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

N/A

Files

memory/2356-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2356-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2356-3-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2356-15-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231215-en

Max time kernel

137s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.173.79.40.in-addr.arpa udp

Files

memory/2672-0-0x00007FFE26310000-0x00007FFE26CB1000-memory.dmp

memory/2672-1-0x00007FFE26310000-0x00007FFE26CB1000-memory.dmp

memory/2672-2-0x0000000000AF0000-0x0000000000B00000-memory.dmp

memory/2672-3-0x000000001B0D0000-0x000000001B176000-memory.dmp

memory/2672-4-0x000000001B650000-0x000000001BB1E000-memory.dmp

memory/2672-5-0x000000001BC40000-0x000000001BCDC000-memory.dmp

memory/2672-6-0x00000000008E0000-0x00000000008E8000-memory.dmp

memory/2672-7-0x000000001BDA0000-0x000000001BDEC000-memory.dmp

memory/2672-8-0x0000000000AF0000-0x0000000000B00000-memory.dmp

memory/2672-9-0x00007FFE26310000-0x00007FFE26CB1000-memory.dmp

memory/2672-10-0x00007FFE26310000-0x00007FFE26CB1000-memory.dmp

memory/2672-11-0x0000000000AF0000-0x0000000000B00000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231129-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

N/A

Files

memory/3028-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3028-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/3028-3-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3028-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231129-en

Max time kernel

140s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

N/A

Files

memory/3032-0-0x0000000000230000-0x0000000000231000-memory.dmp

memory/3032-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/3032-3-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231215-en

Max time kernel

146s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD271C.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD263A.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4140 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1228 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1228 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1228 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 4140 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 1432 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1432 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1432 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 4140 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1508 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 5040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2308 wrote to memory of 5040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2308 wrote to memory of 5040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 49681707826330.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

memory/4140-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\u.wry

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\49681707826330.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 e5079fe05b30b4f31f7acd35a0eb4a9c
SHA1 105a4cc05b76d18846ab725ee59139050d63854e
SHA256 549d4a624f974e277c2ae3ed79d9e51c49e21180567e0eb25ff0b6f708e54b68
SHA512 d53e8389d8b35c1b46c51c9bb8ed63af9bcde681d22aaf2ad0dbd4b1157ac83bb36bff7b6a27fa3d8252bdaa8fb4fc40be013171acbd82ba9f906747d987367d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 c3d068906b1a53409074c78102ab9367
SHA1 93dae0592940be7ce267924a02aa723c52176f7d
SHA256 1aa5f944dc7434dd53f1fc176eb0faeff2227c282b075a2c6c789fa221ca7882
SHA512 c5fb1bc9d16ef534dec5248a9f4b9d92a589d629364bbdb42d70f627e70b8861ff5b80b8ef269278c2a105543cf7e0920f572a10c0fa95f3807e45549d04b721

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 e7757a51ecbdb3fc69e512acba22304d
SHA1 7178ac793ba67dfb9a42fcf68136623c49fadcf7
SHA256 a26aa323eb71887703a474dcb6037417ff8390c3d78eb8a72655a32782deebd5
SHA512 5e7f0dee2aeac4756ade78b2d5e43cc3d073ae464eaefa4b83a3f84c923ffb40b84cc473d1cb3c5d351dd411f199cd928442db41a10b492717a627f2fded6efc

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 f0e373fccab43d46b63f68d91a92999d
SHA1 c2c406d47a4084cc8b2be903f69f844d92356c0b
SHA256 69596a703091fbf280f600ed6b88d777d38ff0f3b7919cf487c4670c2745ff9e
SHA512 25343a7e30e2be53e8e430415d4cbb614a675dfacd16573bb36a58627685c964e9929f71e9def15c233780b70953f92d3df6dd8da7285b713f5fa6638d34c8d7

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 82392efac3db62a04783343bb53f5091
SHA1 03d048c9f4656f99a7a6905cfcbe302ae34fca45
SHA256 833ed2bc6797072aee95cd9622eb4e23c52adc185f08f34f33bc79af062e6177
SHA512 ac0f516810e4b792a77ba2d36c3387c9879c5750d9a97cc13ae208d02143086b1a5c9eb2a83c39694d1afc2966c11aaf9bad9bd4fec1439eac16376071f583e3

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 cb61ffe3fe8e4138c17bddc1241786b9
SHA1 caf3b97b9b8947456cd368e39278f481e7e84185
SHA256 affa68b60ac6fd17ad65e91f722ddb1700a0368e59e3439fbc7b5176b35ab655
SHA512 fb88bf517c078e1dd4fd3c97c6f8837c6ecf6bbc592ae2640431103e9f52a169d1e3b2f7fc8b4a427aa04163c78930ce91f3d0fff7125f9790670d2af590e6cc

Analysis: behavioral23

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231215-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp
PID 2436 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp" /SL5="$30136,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

N/A

Files

memory/2436-1-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-HO4PQ.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/2448-8-0x0000000000240000-0x0000000000241000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-0B1DG.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2436-16-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2448-17-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2448-20-0x0000000000240000-0x0000000000241000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:13

Platform

win10v2004-20231215-en

Max time kernel

88s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{20A18C70-7A5A-4F0F-8330-00AF699EC037} C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4572 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4572 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4572 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3436 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3436 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3436 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3436 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3436 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3436 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39ac055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

memory/4572-0-0x0000000074FF0000-0x00000000757A0000-memory.dmp

memory/4572-1-0x0000000000AF0000-0x000000000119E000-memory.dmp

memory/4572-2-0x0000000005CF0000-0x0000000005D00000-memory.dmp

memory/4572-3-0x00000000062B0000-0x0000000006854000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/4572-14-0x0000000074FF0000-0x00000000757A0000-memory.dmp

memory/4572-15-0x0000000005CF0000-0x0000000005D00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/4572-830-0x0000000005CF0000-0x0000000005D00000-memory.dmp

memory/4572-831-0x000000000BC00000-0x000000000BC38000-memory.dmp

memory/4572-832-0x000000000BBC0000-0x000000000BBCE000-memory.dmp

memory/4572-835-0x0000000005CF0000-0x0000000005D00000-memory.dmp

memory/4572-836-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-838-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-839-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-841-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-840-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-842-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-843-0x000000000C620000-0x000000000C630000-memory.dmp

memory/4572-844-0x000000000C620000-0x000000000C630000-memory.dmp

memory/4572-845-0x000000000C620000-0x000000000C630000-memory.dmp

memory/4572-846-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-847-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-848-0x000000000C620000-0x000000000C630000-memory.dmp

memory/4572-849-0x000000000C460000-0x000000000C470000-memory.dmp

memory/4572-850-0x000000000C620000-0x000000000C630000-memory.dmp

memory/4572-851-0x000000000C620000-0x000000000C630000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 b17223e59994f60c5833030795f2bcac
SHA1 66f5f5caf68849cfe574cbef7f8278dacdafdd5f
SHA256 49fdaa4ee215c3a142144184d0e82964efb4c11c7d8ce726c5806bfca13888ca
SHA512 c7aea16c9327e9c19860c4a1487a94cb7edc8953d57aef9617a6d9accd645eb3fecf5e81f0eca6348f9dea86077d55d00546fc270bcd5d5cb9d8c864d9bf0003

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/4572-877-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231215-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Popup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

memory/3328-0-0x00000000006B0000-0x00000000006B1000-memory.dmp

memory/3328-1-0x0000000000400000-0x00000000004DF000-memory.dmp

memory/3328-3-0x00000000006B0000-0x00000000006B1000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-635608581-3370340891-292606865-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ss657g5n.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 64 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 64 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1548 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 1548 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3728 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3728 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3728 wrote to memory of 4432 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3728 wrote to memory of 4432 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1548 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 1548 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/64-0-0x0000000000070000-0x0000000000080000-memory.dmp

memory/64-1-0x00007FF9563C0000-0x00007FF956E81000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/64-14-0x00007FF9563C0000-0x00007FF956E81000-memory.dmp

memory/1548-15-0x00007FF9563C0000-0x00007FF956E81000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/1548-434-0x00007FF9563C0000-0x00007FF956E81000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:12

Platform

win7-20231215-en

Max time kernel

3s

Max time network

7s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1980 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1980 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1980 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1980 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/1980-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

memory/1980-10-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

memory/1980-9-0x0000000000240000-0x0000000000264000-memory.dmp

memory/2772-13-0x0000000002E10000-0x0000000002E11000-memory.dmp

memory/3028-14-0x0000000002B30000-0x0000000002B31000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:12

Platform

win10v2004-20231222-en

Max time kernel

3s

Max time network

5s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "3" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2244 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2244 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39ac055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp

Files

memory/2244-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sys3.exe

MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 89f10072ebabf67c196f4c140e5b5349
SHA1 e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256 da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512 eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35

memory/2244-6-0x000000002AA00000-0x000000002AA24000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:12

Platform

win7-20231215-en

Max time kernel

26s

Max time network

29s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2336 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\vssadmin.exe
PID 2336 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 2336 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 2336 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\system32\NetSh.exe
PID 2336 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 2336 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 2336 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2336-0-0x0000000000820000-0x00000000012BC000-memory.dmp

memory/2336-1-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

memory/2336-2-0x000000001BBC0000-0x000000001CBD6000-memory.dmp

memory/2336-3-0x0000000000150000-0x0000000000156000-memory.dmp

memory/2336-4-0x000000001B9C0000-0x000000001BA40000-memory.dmp

memory/2336-5-0x000000001B9C0000-0x000000001BA40000-memory.dmp

memory/2336-6-0x000000001B9C0000-0x000000001BA40000-memory.dmp

memory/2336-13-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

memory/2336-16-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

memory/2676-15-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/876-17-0x00000000026E0000-0x00000000026E1000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:12

Platform

win10v2004-20231215-en

Max time kernel

19s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Deletes shadow copies

ransomware

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Disables Task Manager via registry modification

evasion

Disables use of System Restore points

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\NetSh.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\RedEye.exe" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Nope.txt C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "176" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\shutdown.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4704 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4704 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4704 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4704 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4704 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4704 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 4704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\SYSTEM32\NetSh.exe
PID 4704 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe
PID 4704 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe C:\Windows\System32\shutdown.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\RedEye.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SYSTEM32\NetSh.exe

NetSh Advfirewall set allprofiles state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\shutdown.exe

"C:\Windows\System32\shutdown.exe" -r -t 00 -f

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b0855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/4704-0-0x0000022BCD7C0000-0x0000022BCE25C000-memory.dmp

memory/4704-1-0x00007FFBF8AA0000-0x00007FFBF9561000-memory.dmp

memory/4704-2-0x0000022BE8920000-0x0000022BE9936000-memory.dmp

memory/4704-3-0x0000022BCE670000-0x0000022BCE676000-memory.dmp

memory/4704-4-0x0000022BE8890000-0x0000022BE88A0000-memory.dmp

memory/4704-5-0x0000022BE8890000-0x0000022BE88A0000-memory.dmp

memory/4704-13-0x00007FFBF8AA0000-0x00007FFBF9561000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231215-en

Max time kernel

141s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp
PID 5088 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp
PID 5088 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp

"C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp" /SL5="$6006C,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/5088-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/5088-2-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-4L579.tmp\butterflyondesktop.tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

memory/632-7-0x00000000007A0000-0x00000000007A1000-memory.dmp

memory/5088-13-0x0000000000400000-0x0000000000414000-memory.dmp

memory/632-14-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/632-17-0x00000000007A0000-0x00000000007A1000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231215-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMPORTANT.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1603059206-2004189698-4139800220-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gnnqx2hai.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1344 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1344 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1344 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2536 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2536 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2536 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 2620 wrote to memory of 1144 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2620 wrote to memory of 1144 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2620 wrote to memory of 1144 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2620 wrote to memory of 2464 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2620 wrote to memory of 2464 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2620 wrote to memory of 2464 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2536 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2536 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 2536 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Electron V2.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\IMPORTANT.txt

Network

N/A

Files

memory/1344-0-0x00000000012D0000-0x00000000012E0000-memory.dmp

memory/1344-1-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 b1228ba24ca5f75f8df9d5d177e5bb2b
SHA1 1895758de51ccfefa40239aa11055540c8c5deb7
SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
SHA512 7abc1df0089a1a00aadc11c33eecffb5d85258acc4eac0b261ceaea77e814eaf671506383fe0074fd5779b8bc58e0f48f0d15309aa81aecf27ecc6633da4c5a4

memory/2536-7-0x0000000000890000-0x00000000008A0000-memory.dmp

memory/1344-8-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

memory/2536-9-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

memory/2536-11-0x000000001AFD0000-0x000000001B050000-memory.dmp

C:\Users\Admin\Documents\IMPORTANT.txt

MD5 46fe77013e7336b17e5270cc708a1da4
SHA1 c8949dbcaac904160eacafcbde51b52c0e5110f1
SHA256 fff91118e1d44de84c1876cfcb6ee5413c336dca888efb2d9af084047fe06cf6
SHA512 b4e5bc4e20005c869e914ab9314944215dced635991772896d07731bf1711708ce74f5660bab8669de965eeac00ce7b56cfb5fd650437dfe3336c90eb3790d52

memory/2536-449-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

memory/2536-450-0x000000001AFD0000-0x000000001B050000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:12

Platform

win7-20231129-en

Max time kernel

4s

Max time network

6s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2948 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2636 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2636 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2636 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2636 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2636 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2948-0-0x00000000746D0000-0x0000000074DBE000-memory.dmp

memory/2948-1-0x00000000010D0000-0x000000000177E000-memory.dmp

memory/2948-2-0x00000000050F0000-0x0000000005130000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2948-16-0x0000000000A60000-0x0000000000A6A000-memory.dmp

memory/2948-15-0x0000000000A60000-0x0000000000A6A000-memory.dmp

memory/2948-17-0x00000000050F0000-0x0000000005130000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/2948-28-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

memory/2948-33-0x0000000000E40000-0x0000000000E4A000-memory.dmp

memory/2948-32-0x0000000000E40000-0x0000000000E4A000-memory.dmp

memory/2948-34-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

memory/2948-31-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

memory/2948-30-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

memory/2948-29-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

memory/2948-36-0x0000000000F50000-0x0000000000F5A000-memory.dmp

memory/2948-37-0x0000000000F50000-0x0000000000F5A000-memory.dmp

memory/2948-35-0x0000000000E40000-0x0000000000E4A000-memory.dmp

memory/2948-27-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

memory/2948-26-0x000000006B7A0000-0x000000006BAB2000-memory.dmp

memory/2948-38-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2948-847-0x0000000000E40000-0x0000000000E4A000-memory.dmp

memory/2948-846-0x00000000050F0000-0x0000000005130000-memory.dmp

memory/2948-845-0x00000000746D0000-0x0000000074DBE000-memory.dmp

memory/2948-848-0x000000006B7A0000-0x000000006BAB2000-memory.dmp

memory/2948-849-0x0000000000F50000-0x0000000000F5A000-memory.dmp

memory/2248-844-0x0000000002E90000-0x0000000002E91000-memory.dmp

memory/964-850-0x0000000002B30000-0x0000000002B31000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231222-en

Max time kernel

144s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Christmas.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 130.109.69.13.in-addr.arpa udp

Files

memory/2440-0-0x0000000002210000-0x0000000002211000-memory.dmp

memory/2440-1-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-2-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-3-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-4-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-5-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-6-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-7-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-9-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-10-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-11-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-12-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-13-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2440-14-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231215-en

Max time kernel

121s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\CookieClickerHack.exe"

Network

N/A

Files

memory/3000-0-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

memory/3000-1-0x00000000009E0000-0x0000000000A60000-memory.dmp

memory/3000-2-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

memory/3000-3-0x00000000009E0000-0x0000000000A60000-memory.dmp

memory/3000-5-0x00000000009E0000-0x0000000000A60000-memory.dmp

memory/3000-4-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231215-en

Max time kernel

92s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231215-en

Max time kernel

148s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD934D.tmp C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Malware-database-main\\WannaCry.exe\" /r" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2788 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2788 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2788 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2184 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\taskkill.exe
PID 2184 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Windows\SysWOW64\cmd.exe
PID 624 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 624 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 624 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 624 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 2184 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
PID 1864 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe C:\Windows\SysWOW64\cmd.exe
PID 1736 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1736 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1736 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1736 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c 194241707826320.bat

C:\Windows\SysWOW64\cscript.exe

cscript //nologo c.vbs

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe f

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im MSExchange*

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlwriter.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im sqlserver.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Microsoft.Exchange.*

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe c

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b !WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe v

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

!WannaDecryptor!.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

Network

Country Destination Domain Proto
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9150 tcp

Files

memory/2184-6-0x0000000010000000-0x0000000010012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\194241707826320.bat

MD5 71e08345a9f96647941595bc404e4304
SHA1 207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5
SHA256 04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16
SHA512 5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

MD5 897fe8eafbce679f3f2ecae2f678753a
SHA1 3e0cef18216c559e6bdf9c1c5331d8d5d2e53398
SHA256 04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a
SHA512 979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe

MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

MD5 9192a8af3ddb4eed7f704935fe034922
SHA1 0489c3b907d6046f3fa13871e689136fcf7efe39
SHA256 ec77e7c8b292703f0a0bb941bf60b728921402b0022db717aa6d43f0343144df
SHA512 5a2b9c0a4c73748ce3b73af42b29306e94631ffbef395780f3dd00c12c28a275cada7ce7a05959c36ef5d7292af97ab868c7616ae9a1ab186a871341de990c93

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 56762a09a63b5b1c499696b7823e10e5
SHA1 f2e0efc1c52bf9dd48529407119c3d659563db86
SHA256 ccbc1412db9e21a18f12a4e2191a6f01e6257395a030a7f971373d90fff83925
SHA512 82794b4b1e5c205e0c1ad10900a0f04efa38d61ad8d1a8211971fe5a241ec5a2b1cbe4e21ae8b0a4b298f30c8ff6266241a1fe91f59d5bdb289d544d98bf1b1d

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

MD5 60c8f2e411e0ad202baf314f4babde06
SHA1 4069bbe99812fbb4834b7ba3b0dd35c059bb4faf
SHA256 79cb7e3275993c6dceb319438ff97ad7d6668fe67c354916a839e797969df039
SHA512 531a249c173e5a49e2c5c5c53e66db9707d35fd9115508742a1f33173fe3a6d025c877486014e11dd5af6ae59462088fde9ac8c36aeea40d4b983f2d8e1a58e8

C:\Users\Admin\Documents\!Please Read Me!.txt

MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 9c070add1c099204c222ccc930367c61
SHA1 0f2c28214ff2d9504f44abe234c5cbb4bf085d01
SHA256 96fc564e26c9ff45cf472442f9e1e6bd8522f61d6729625a2dc18b0ae21b8566
SHA512 ca647787e71e7fc8aee6a8108b0708e08016bcbc3b179b11a61e428fc7b7a712d35a5b65f8d0c577f21d55ce6830e6af40f5062735f88ed445f12c36cff32df9

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

MD5 ab2da20a24b50708883fd179bdfd7824
SHA1 45c34602c873163038b8223285e89ab279160d59
SHA256 cf984697a95560820aa4bddec995a73161037d78a5b66194ef0026e5d85bbfc2
SHA512 a82ec14c44d591d164ea82db9dc5048bde4a7c41f75a6f1cf08c68d693eda2db3a9f76fb57793397f10750f398049b9ecd26f9ad8d1f94d99c95b1a1d8f35b04

Analysis: behavioral4

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231222-en

Max time kernel

93s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp

Files

memory/2936-0-0x0000000000330000-0x0000000000794000-memory.dmp

memory/2936-1-0x00007FFDCF590000-0x00007FFDD0051000-memory.dmp

memory/2936-2-0x000000001B480000-0x000000001B490000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/2936-13-0x000000001B480000-0x000000001B490000-memory.dmp

memory/2936-15-0x000000001D300000-0x000000001D308000-memory.dmp

memory/2936-16-0x000000001B480000-0x000000001B490000-memory.dmp

memory/2936-17-0x00007FFDCF590000-0x00007FFDD0051000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win10v2004-20231222-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\Flasher.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp

Files

memory/2880-0-0x0000000002350000-0x0000000002351000-memory.dmp

memory/2880-1-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2880-3-0x0000000002350000-0x0000000002351000-memory.dmp

memory/2880-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-02-13 12:11

Reported

2024-02-13 12:14

Platform

win7-20231215-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe

"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\MEMZ Trojan.exe"

Network

N/A

Files

N/A