Malware Analysis Report

2024-11-16 12:44

Sample ID 240302-3jrj5sag82
Target Trojan.zip
SHA256 efabf829c3d87a714b87c2690786b8e12ca7995ad9bb00aff93f2b4a0fc2c88e
Tags
bootkit evasion persistence ransomware spyware stealer trojan upx discovery exploit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

efabf829c3d87a714b87c2690786b8e12ca7995ad9bb00aff93f2b4a0fc2c88e

Threat Level: Known bad

The file Trojan.zip was found to be: Known bad.

Malicious Activity Summary

bootkit evasion persistence ransomware spyware stealer trojan upx discovery exploit

Windows security bypass

Disables Task Manager via registry modification

Drops file in Drivers directory

Disables RegEdit via registry modification

Possible privilege escalation attempt

Loads dropped DLL

UPX packed file

Reads user/profile data of web browsers

Checks computer location settings

Modifies file permissions

Windows security modification

Executes dropped EXE

ACProtect 1.3x - 1.4x DLL software

Modifies boot configuration data using bcdedit

Adds Run key to start application

Modifies WinLogon

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

NSIS installer

Suspicious behavior: CmdExeWriteProcessMemorySpam

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Views/modifies file attributes

Modifies Internet Explorer start page

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Delays execution with timeout.exe

Runs net.exe

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

System policy modification

Kills process with taskkill

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-02 23:33

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

122s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:44

Platform

win7-20240221-en

Max time kernel

48s

Max time network

60s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 1220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2464 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2464 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2464 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2464 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2464 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/3048-1-0x0000000074640000-0x0000000074D2E000-memory.dmp

memory/3048-0-0x0000000000BF0000-0x000000000129E000-memory.dmp

memory/3048-2-0x0000000000380000-0x00000000003C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/3048-15-0x0000000000380000-0x00000000003C0000-memory.dmp

memory/3048-16-0x0000000000500000-0x000000000050A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/3048-25-0x000000006B820000-0x000000006BB32000-memory.dmp

memory/3048-27-0x0000000000B00000-0x0000000000B0A000-memory.dmp

memory/3048-26-0x0000000000B00000-0x0000000000B0A000-memory.dmp

memory/3048-28-0x0000000000B00000-0x0000000000B0A000-memory.dmp

memory/3048-29-0x0000000000B00000-0x0000000000B0A000-memory.dmp

memory/3048-30-0x0000000000B00000-0x0000000000B0A000-memory.dmp

memory/3048-32-0x0000000000B00000-0x0000000000B0A000-memory.dmp

memory/3048-31-0x0000000000B60000-0x0000000000B6A000-memory.dmp

memory/3048-33-0x0000000000B60000-0x0000000000B6A000-memory.dmp

memory/3048-34-0x0000000000B60000-0x0000000000B6A000-memory.dmp

memory/3048-35-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

memory/3048-36-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

memory/3048-37-0x0000000000710000-0x0000000000711000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/3048-297-0x0000000074640000-0x0000000074D2E000-memory.dmp

memory/3048-750-0x0000000000380000-0x00000000003C0000-memory.dmp

memory/2920-846-0x0000000002B80000-0x0000000002B81000-memory.dmp

memory/3048-847-0x0000000074640000-0x0000000074D2E000-memory.dmp

memory/3048-845-0x000000006B820000-0x000000006BB32000-memory.dmp

memory/3048-848-0x0000000000BD0000-0x0000000000BD5000-memory.dmp

memory/3048-849-0x0000000000B60000-0x0000000000B6A000-memory.dmp

memory/2408-850-0x00000000027A0000-0x00000000027A1000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

122s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/1444-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/4768-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:44

Platform

win7-20240221-en

Max time kernel

69s

Max time network

43s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" \??\c:\windows\antivirus-platinum.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
N/A N/A N/A N/A
N/A N/A C:\WINDOWS\302746537.exe N/A
N/A N/A \??\c:\windows\antivirus-platinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AnVi\splash.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
File created C:\Program Files (x86)\AnVi\virus.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_259409070 C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\windows\antivirus-platinum.exe C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl\CurVer\ = "COMCTL.ListViewCtrl.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\ToolboxBitmap32\ = "c:\\windows\\mscomctl.ocx, 2" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\ = "IListSubItems" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8556BCD2-E01E-11CF-8E74-00A0C90F26F8}\ = "IImage" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE5-8583-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl.2\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ = "IListItems" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Version\ = "2.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\CurVer\ = "MSComctlLib.Toolbar.2" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ = "IPanel10" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl.2\ = "Microsoft ProgressBar Control 6.0 (SP4)" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 17" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\windows\antivirus-platinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2908 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2908 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2908 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2648 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2648 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2648 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2648 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2648 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2648 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2648 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2648 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2648 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2648 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2648 wrote to memory of 2696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2648 wrote to memory of 2696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2648 wrote to memory of 2696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2456 wrote to memory of 2924 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2924 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2924 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2924 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
PID 2924 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2924 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2924 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2924 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2924 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2924 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2924 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2924 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2648 wrote to memory of 348 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2648 wrote to memory of 348 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2648 wrote to memory of 348 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2648 wrote to memory of 348 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2648 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2648 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2648 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System \??\c:\windows\antivirus-platinum.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2CDA.tmp\2CDB.tmp\2CDC.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\44EC.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC4E30.tmp.vbs"

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\75BC.tmp\75BD.tmp\75BE.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\75CC.tmp\VirusCan.bat""

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2708 -s 656

Network

Country Destination Domain Proto
US 8.8.8.8:53 frequentwin.com udp
US 8.8.8.8:53 fastsofgeld.com udp
US 8.8.8.8:53 searchdusty.com udp
CA 54.39.157.64:80 searchdusty.com tcp
US 8.8.8.8:53 highway-traffic.com udp

Files

C:\Users\Admin\AppData\Local\Temp\2CDA.tmp\2CDB.tmp\2CDC.bat

MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

memory/2736-42-0x0000000001DD0000-0x0000000001DD6000-memory.dmp

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/2456-49-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2736-47-0x0000000001E40000-0x0000000001E50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44EC.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

\??\c:\windows\comctl32.ocx

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

memory/2624-70-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/2924-68-0x0000000000130000-0x000000000013D000-memory.dmp

memory/2456-73-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

memory/2248-80-0x0000000000010000-0x0000000000018000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

memory/2248-110-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1328-96-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

memory/1032-113-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1656-90-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1400-114-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1500-116-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1444-115-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1328-117-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1772-118-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2124-119-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2052-120-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2424-121-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2780-122-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2672-123-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2276-124-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2096-125-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2320-126-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1032-127-0x0000000004870000-0x00000000048B0000-memory.dmp

memory/1400-128-0x00000000047E0000-0x0000000004820000-memory.dmp

memory/1444-129-0x00000000047B0000-0x00000000047F0000-memory.dmp

memory/2096-130-0x00000000046D0000-0x0000000004710000-memory.dmp

memory/1772-139-0x0000000004660000-0x00000000046A0000-memory.dmp

memory/2780-140-0x0000000004570000-0x00000000045B0000-memory.dmp

memory/1012-143-0x0000000001EB0000-0x0000000001EF0000-memory.dmp

memory/2220-144-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1548-145-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1548-146-0x0000000001EC0000-0x0000000001F00000-memory.dmp

memory/1328-142-0x0000000000250000-0x0000000000290000-memory.dmp

memory/1012-141-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1500-138-0x00000000046E0000-0x0000000004720000-memory.dmp

memory/2220-137-0x00000000048B0000-0x00000000048F0000-memory.dmp

memory/1656-136-0x0000000001DD0000-0x0000000001E10000-memory.dmp

memory/2052-135-0x0000000004830000-0x0000000004870000-memory.dmp

memory/2124-134-0x0000000002040000-0x0000000002080000-memory.dmp

memory/2672-133-0x0000000004140000-0x0000000004180000-memory.dmp

memory/2424-132-0x0000000001DF0000-0x0000000001E30000-memory.dmp

memory/2248-131-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

memory/2736-149-0x0000000001E40000-0x0000000001E50000-memory.dmp

memory/1328-150-0x0000000000250000-0x0000000000290000-memory.dmp

memory/2624-151-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

memory/1032-159-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1656-158-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2096-160-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1400-163-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1444-164-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1328-166-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1772-167-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2124-168-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2052-169-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2424-170-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2780-171-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2276-173-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2320-174-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1032-175-0x0000000004870000-0x00000000048B0000-memory.dmp

memory/2672-172-0x0000000074190000-0x000000007487E000-memory.dmp

memory/1400-176-0x00000000047E0000-0x0000000004820000-memory.dmp

memory/1500-165-0x0000000074190000-0x000000007487E000-memory.dmp

memory/2248-162-0x0000000074190000-0x000000007487E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 ed6850b4fd4bbe49853aa0c8d11c559f
SHA1 bcb56054ff868be782b182d464287c59ae6817e8
SHA256 53e4dea75cb5f625b174b47562a1739c309b9e883ca3b5c3f0273abb7acf682b
SHA512 b822d6f05936d00a1fa21780aaa111355e197ddb01f1a31b3e0c01f55ae0da3e4965b26f5cdca08b0b577086299d949a467d13039e119344c766f44f796190db

memory/1360-227-0x0000000000400000-0x000000000040E000-memory.dmp

\Users\Admin\AppData\Local\Temp\nso73F9.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

\Users\Admin\AppData\Local\Temp\nso73F9.tmp\GetVersion.dll

MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 7a0dde676273569966f442d203b25b31
SHA1 96443c3966ce6d5cd332d8257be8fc3e9306c319
SHA256 3c5aa7cf099b14996bba31ccd20be58c88c5c7a79fc6af43b081edef70da2803
SHA512 bb999f7aa09120e326d66553a7c5278b7d6399b560fb255e2cb05e6d566f2c202d425c93cfa68604fa7f7098adcd177e5703a8ea683449810ac476eb2a3cd9cd

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 82e0e9f8e0576837610117e6f705bc5c
SHA1 8e2dd01c4ab2ae1e9068b4578b78a2dedb859652
SHA256 96f9af12f79ae73912bc483fa032bd928674799937e655423018410f5e3124f0
SHA512 8df710ddeb284693371fc1ce38242ce493d5036db50027bf56b377b45f8cb928bc186ea3e4c1bb02265a76467b9bdad2aad440d73394882e9587f7d45517c185

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

memory/1944-246-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\75CC.tmp\VirusCan.bat

MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 714a82f547c2cf783201c7ab20edbc32
SHA1 959a295c7d5818638c6bd452fd9b8e0b5c21602b
SHA256 48264ea35fdb5b00e32f675465104f73e87c4ff81f7857ce13ff39bb6ff1e650
SHA512 19f6471cb17cd8110ae2c160855620ae0016e7d7578de9c6418793b831692118222d7c5680bef820d11f617601efd67e0014c7d7172c9df8dd466821e397e77e

memory/2692-254-0x0000000000400000-0x000000000043E000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:48

Platform

win7-20240221-en

Max time kernel

120s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BE9E.tmp\BE9F.tmp\BEA0.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\BE9E.tmp\BE9F.tmp\BEA0.bat

MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4740 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 4740 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9078.tmp\9079.tmp\907A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\9078.tmp\9079.tmp\907A.bat

MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

145s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259450067.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259450067.bat

MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/2820-12-0x0000000002130000-0x0000000002131000-memory.dmp

memory/2264-17-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2820-19-0x0000000002130000-0x0000000002131000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

97s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\winconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 812 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 812 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 812 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 812 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2256 wrote to memory of 2076 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 2076 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 2076 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 2076 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2076 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2076 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2076 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2076 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2076 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2076 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2076 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2076 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 1744 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 1744 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 1744 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2076 wrote to memory of 2764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8A84.tmp\8A85.tmp\8A86.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T

Network

N/A

Files

\Windows\Temp\winconfig.exe

MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\8A84.tmp\8A85.tmp\8A86.bat

MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

1s

Max time network

9s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

13s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4524 -ip 4524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 488

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

7s

Max time network

44s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5096 -ip 5096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 488

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp

Files

memory/4740-0-0x0000000074930000-0x00000000750E0000-memory.dmp

memory/4740-1-0x0000000000AB0000-0x0000000000AC8000-memory.dmp

memory/4740-2-0x00000000059E0000-0x0000000005F84000-memory.dmp

memory/4740-3-0x00000000054D0000-0x0000000005562000-memory.dmp

memory/4740-4-0x0000000005690000-0x00000000056A0000-memory.dmp

memory/4740-5-0x0000000005670000-0x000000000567A000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:45

Platform

win10v2004-20240226-en

Max time kernel

44s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\WINDOWS\302746537.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AnVi\splash.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
File created C:\Program Files (x86)\AnVi\virus.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240655078 C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.ListViewCtrl" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\ = "Slider Appearance Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CLSID\ = "{9ED94440-E5E8-101B-B9B5-444553540000}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.ImageListCtrl.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1\ = "172433" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ = "Microsoft ImageList Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Control C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\ = "Microsoft Slider Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32\ = "c:\\windows\\comctl32.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\ToolboxBitmap32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\ = "Microsoft Slider Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Version C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "c:\\windows\\comctl32.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1\ = "131473" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} C:\Windows\SysWOW64\regsvr32.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 1668 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 3496 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3496 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3496 wrote to memory of 2024 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 3496 wrote to memory of 2024 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 3496 wrote to memory of 2024 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 3496 wrote to memory of 60 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 3496 wrote to memory of 60 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 3496 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 3496 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 3496 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 3496 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3496 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1356 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 1356 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 1356 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 3496 wrote to memory of 1852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 3496 wrote to memory of 1852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 3496 wrote to memory of 1852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 3496 wrote to memory of 2360 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 2360 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 2360 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 1104 wrote to memory of 5040 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 1104 wrote to memory of 5040 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 1104 wrote to memory of 5040 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 3904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3496 wrote to memory of 3904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3496 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
PID 3496 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
PID 3496 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
PID 3496 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 1252 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 1252 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 3496 wrote to memory of 1252 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 5040 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 5040 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 5040 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B7.tmp\C7.tmp\C8.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2025.tmp\302746537.bat" "

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC55BC.tmp.vbs"

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9006.tmp\VirusCan.bat""

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\912F.tmp\9130.tmp\9131.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x514 0x300

C:\Windows\SysWOW64\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\B7.tmp\C7.tmp\C8.bat

MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/1104-52-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2360-69-0x0000000000390000-0x0000000000398000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2025.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

memory/1468-72-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/4412-75-0x0000000005750000-0x00000000057E2000-memory.dmp

memory/3772-74-0x0000000005A40000-0x0000000005FE4000-memory.dmp

memory/2360-76-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/3772-78-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/2808-79-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/4412-81-0x0000000005800000-0x0000000005810000-memory.dmp

memory/1468-82-0x0000000005760000-0x0000000005770000-memory.dmp

C:\Windows\COMCTL32.OCX

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

memory/3772-86-0x0000000005500000-0x0000000005510000-memory.dmp

memory/2360-85-0x0000000004D60000-0x0000000004D70000-memory.dmp

memory/4412-87-0x0000000073E00000-0x00000000745B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

memory/1428-91-0x0000000000830000-0x0000000000840000-memory.dmp

memory/4748-92-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/2808-93-0x0000000004930000-0x0000000004940000-memory.dmp

memory/1252-95-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1428-97-0x00000000050D0000-0x00000000050E0000-memory.dmp

memory/1428-98-0x00000000052A0000-0x00000000052AA000-memory.dmp

memory/1252-96-0x00000000027F0000-0x0000000002800000-memory.dmp

memory/1428-100-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1940-101-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1632-104-0x0000000004A10000-0x0000000004A20000-memory.dmp

memory/1632-102-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/2420-105-0x0000000073E00000-0x00000000745B0000-memory.dmp

C:\Windows\MSCOMCTL.OCX

MD5 fdc0e14efd143d956d8ba0e423644c8f
SHA1 20c966fc327b5629af85151245853b84f178561e
SHA256 91646395e27b321b465797f65d9a67f2c891902cc8daf3885b94230cdf83ace3
SHA512 102d7e362307b7a09d149099792ac08bd9af2a32d20c839cb6891896ba10bcd0080b32eee7bbf51414d98b9ccd9e2b77d4a7aad9aa9bb635e7019d9fb4f5487d

\??\c:\windows\mscomctl.ocx

MD5 c83e5b6cdfbe073bcdd83167c04d9e3b
SHA1 c99a2672f4e8daa62c8d5e0406bf246b8f8e1858
SHA256 a5c57d1640a116dfaaff15f5c0f60c78de6e5a8d91627688f9afa75cbb1f8735
SHA512 9bc032bc10b46629379d4aeb34976b5ca838d78008581f09cc5112afeabf03fd661be22d8a82e95ced161f2b6be7b9c3c8c79fb274faf32cada9d372ea17b16b

memory/4984-110-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/2420-111-0x0000000004A80000-0x0000000004A90000-memory.dmp

memory/4984-112-0x0000000005400000-0x0000000005410000-memory.dmp

memory/4408-113-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1468-115-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/3772-116-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/4408-117-0x0000000004B80000-0x0000000004B90000-memory.dmp

memory/2808-120-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1468-121-0x0000000005760000-0x0000000005770000-memory.dmp

memory/3772-122-0x0000000005500000-0x0000000005510000-memory.dmp

memory/1104-119-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2772-118-0x0000000073E00000-0x00000000745B0000-memory.dmp

\??\c:\windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/4412-129-0x0000000005800000-0x0000000005810000-memory.dmp

memory/2360-131-0x0000000004D60000-0x0000000004D70000-memory.dmp

memory/2360-128-0x0000000073E00000-0x00000000745B0000-memory.dmp

C:\Windows\MSCOMCTL.OCX

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

memory/4672-137-0x0000000000400000-0x000000000040E000-memory.dmp

memory/4748-139-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1252-140-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1428-141-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/2908-143-0x0000000073E00000-0x00000000745B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

memory/4760-149-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1072-154-0x0000000073E00000-0x00000000745B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SFC55BC.tmp.vbs

MD5 c9f89015e169c812c60401d74883575f
SHA1 213bb6cde1d5930dcfa5e5584e42d52c4d160108
SHA256 77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056
SHA512 c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e

memory/2808-157-0x0000000004930000-0x0000000004940000-memory.dmp

memory/4412-155-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/4748-159-0x0000000000C40000-0x0000000000C50000-memory.dmp

memory/1252-160-0x00000000027F0000-0x0000000002800000-memory.dmp

memory/1428-161-0x00000000050D0000-0x00000000050E0000-memory.dmp

memory/1940-162-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1104-164-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2688-165-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/2688-167-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

memory/1940-168-0x00000000051E0000-0x00000000051F0000-memory.dmp

memory/3476-169-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1632-170-0x0000000004A10000-0x0000000004A20000-memory.dmp

memory/3592-171-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/1632-173-0x0000000073E00000-0x00000000745B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 252d1457cab5364d964d0c773acacb93
SHA1 7f0efc9f153803869ebb1b734651586e2f2900fb
SHA256 acb40687e1c65626d480a10cfb9738fe991f34016fe6b17110725cccbc744daf
SHA512 9584f36254810c5a217683c81e1b2a6cc7ae47e65906e04a0d7c83b0e9b8de1d96a0efa505ee4f8ba52a9a97aa0defc271fe5c0d42ec2f05881890d908175e36

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 383d3cc27ee48f389a201f7e091848d1
SHA1 82d72ecdafd5e7c2512950f76efe2ed6f8f73373
SHA256 8f6d5742a2491c4ab07cf86dda417af66c3a18142d3f74550707396d5089a7e7
SHA512 d2a754eff29e0de496ee531a68547a6078f5344225d0a1e9b23b40b0b5e3dda5d5b88bfd4b51e50dd2192ee1d5d12570435d586bb1c351dc16b9d2a6ae5eebc9

C:\Users\Admin\AppData\Local\Temp\nsh8A98.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

C:\Users\Admin\AppData\Local\Temp\nsh8A98.tmp\GetVersion.dll

MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

memory/2420-194-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/4984-198-0x0000000073E00000-0x00000000745B0000-memory.dmp

memory/4836-200-0x0000000074A00000-0x0000000074A09000-memory.dmp

memory/4836-201-0x0000000074A00000-0x0000000074A09000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

memory/4396-199-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9006.tmp\VirusCan.bat

MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

C:\Users\Admin\AppData\Local\Temp\912F.tmp\9130.tmp\9131.bat

MD5 d03b3332e0eb70b0f9a987cabe089c17
SHA1 7d27ee89e5e7f02544728d9f5d227945eba76e56
SHA256 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88
SHA512 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 3af1b0b662b69350dbf6538af1c8b511
SHA1 85ff40507b60ee30f67c80b1125c3e59534a7581
SHA256 b67351f0f92fde3916f5c58d0decd40b3e09ab6ae360a1605ead29c06141bb58
SHA512 d624ad7ea669e5f55b033a938d6939ffe70f01008e58aeb984a34c851b0e89ea6788bc3171e68045a1547ed6addfd4c0d4c04ecc4505e3da0711b613c7d6e8f3

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 b531fc651f4a343a0b435a629db6eb8a
SHA1 98e9adc1dd5cee987cff1a4a13a6f77f16cf600b
SHA256 eeb5c8dc11d30326379ef6c929be50de3492900d09e34a70007cbab7301ac848
SHA512 9606c2e0b342f8b0e4f4184f4abf4c4df2de8e97c4d32c75f40919962e9c95ba70f6108834b23adc8d45400f86633a3bfde88a01d81a8cdd737d8f638458f2e5

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/4396-239-0x0000000000400000-0x0000000000410000-memory.dmp

memory/4396-247-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 f0b946514d137c5a4a96715078d18c6f
SHA1 5329a5fc267b0c96edddf260b84f4c1593000c8b
SHA256 2d71e466959ba530aa3fa1fe675d01515d91df3cb3b94ae396f15e25ccf6cfc0
SHA512 6fd7d887d811c67ee0e2312629781266cda2759dcd4bd64eaaff588eae877504d6527d899cf546fbae32ad7b989e8f30316308eb33aebf34f883b56c46d96ef5

C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4

MD5 9428747737910337c0db28c464233343
SHA1 7194b2a497994e977f012d037fea32e638f4174a
SHA256 5d22e3a494f22cc03ccbc5d4bc5716d345708b8d943a5ff8f1ebc314e532631a
SHA512 97ee18c81dcaf6eff8fd4438f65977b49d6a5c16d9f8e1f64f013dc9507cf77275c7d08c1a5b161738c3b3752013263f0b54efee4f819f1a5bb4f27f32992325

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240672875.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 200.64.52.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\240672875.bat

MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/440-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

118s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A9C7.tmp\A9C8.tmp\A9C9.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\A9C7.tmp\A9C8.tmp\A9C9.bat

MD5 cffeffdd19a93f72fce9ae0b27fc7d41
SHA1 d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA256 f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
SHA512 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

165s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.178.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:45

Platform

win7-20240220-en

Max time kernel

0s

Max time network

7s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:43

Platform

win7-20240221-en

Max time kernel

4s

Max time network

10s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1912 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2468 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2468 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2468 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2468 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2468 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2468 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2468 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2468 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/1912-0-0x0000000074790000-0x0000000074E7E000-memory.dmp

memory/1912-1-0x0000000000E10000-0x00000000014DA000-memory.dmp

memory/1912-2-0x0000000005490000-0x00000000054D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

C:\Users\Admin\AppData\Local\Temp\noway.txt

MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/1912-824-0x0000000074790000-0x0000000074E7E000-memory.dmp

memory/1016-823-0x0000000002D70000-0x0000000002D71000-memory.dmp

memory/1688-825-0x0000000002B30000-0x0000000002B31000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:44

Platform

win10v2004-20240226-en

Max time kernel

50s

Max time network

74s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "117" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4676 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 4676 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 4676 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 3588 wrote to memory of 1352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3588 wrote to memory of 1352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3588 wrote to memory of 1352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3588 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3588 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3588 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3588 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3588 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3588 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3588 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 3588 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 3588 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4184 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3940855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/4676-0-0x0000000075100000-0x00000000758B0000-memory.dmp

memory/4676-1-0x00000000007A0000-0x0000000000E6A000-memory.dmp

memory/4676-2-0x0000000005E00000-0x00000000063A4000-memory.dmp

memory/4676-3-0x0000000005850000-0x00000000058E2000-memory.dmp

memory/4676-4-0x0000000005820000-0x0000000005830000-memory.dmp

memory/4676-5-0x0000000005920000-0x000000000592A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5 1752fc8c651ac03a9c863946ac76366d
SHA1 03b4668b7f6b09f55b73be9c67e8d24850eeecaf
SHA256 2b0c1632471eb16a8731dd0a6396d98209f8cbb9aab7cca6864fdedde87f71c6
SHA512 46f9b269843cd9c636c4511aa7fc9b640bcb675490e15258b6eec6f02c179a3a396da9de32238df6600d3bad3ff5c46da56a35f69b9a0873e0d7272ec33bcc94

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

memory/4676-20-0x0000000005820000-0x0000000005830000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\noway.txt

MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/4676-822-0x0000000075100000-0x00000000758B0000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

119s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 2120 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 2120 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1FD0.tmp\1FD1.tmp\1FD2.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\1FD0.tmp\1FD1.tmp\1FD2.bat

MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

90s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1184 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe
PID 1184 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\51BA.tmp\51BB.tmp\51BC.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\51BA.tmp\51BB.tmp\51BC.bat

MD5 cffeffdd19a93f72fce9ae0b27fc7d41
SHA1 d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA256 f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
SHA512 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:44

Platform

win7-20240221-en

Max time kernel

36s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/1948-0-0x00000000000B0000-0x00000000000D6000-memory.dmp

memory/1948-1-0x00000000745D0000-0x0000000074CBE000-memory.dmp

memory/1948-2-0x0000000004C70000-0x0000000004CB0000-memory.dmp

memory/2760-3-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1948-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

memory/1948-5-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240221-en

Max time kernel

27s

Max time network

22s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

memory/2620-0-0x0000000000990000-0x00000000009A8000-memory.dmp

memory/2620-1-0x0000000074D00000-0x00000000753EE000-memory.dmp

memory/2620-2-0x0000000004990000-0x00000000049D0000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win7-20240215-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259399835.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259399835.bat

MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/2288-12-0x00000000004C0000-0x00000000004C1000-memory.dmp

memory/1268-34-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:45

Platform

win10v2004-20240226-en

Max time kernel

121s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 568 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 568 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\52E3.tmp\52F3.tmp\52F4.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\52E3.tmp\52F3.tmp\52F4.bat

MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:48

Platform

win10v2004-20240226-en

Max time kernel

87s

Max time network

267s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "30" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{B0CB6927-24A2-4FD3-BFF8-9FF156009BF4} C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 1168 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1168 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1168 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1168 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1168 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1168 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1168 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1168 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1168 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1168 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1168 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1168 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1168 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 1168 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 1168 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b4855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 200.64.52.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 138.91.171.81:80 tcp

Files

memory/1988-0-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/1988-1-0x00000000008B0000-0x0000000000F5E000-memory.dmp

memory/1988-2-0x0000000001800000-0x0000000001810000-memory.dmp

memory/1988-3-0x0000000005FD0000-0x0000000006574000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/1988-11-0x0000000001800000-0x0000000001810000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/1988-22-0x000000000C570000-0x000000000C5A8000-memory.dmp

memory/1988-23-0x0000000009380000-0x000000000938E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/1988-29-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-31-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-32-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-34-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-35-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-36-0x000000000C770000-0x000000000C780000-memory.dmp

memory/1988-37-0x000000000C770000-0x000000000C780000-memory.dmp

memory/1988-39-0x000000000C770000-0x000000000C780000-memory.dmp

memory/1988-41-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-38-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-42-0x000000000C770000-0x000000000C780000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 492989efbc803beb896b372847722a37
SHA1 d8fcdab9319938dcb42a2c4270a1815c4a666cb9
SHA256 7a9113c79bdc0c2725beb8968f170b4d1ded9760d41d6d9302f04443900bc01b
SHA512 971ce451aac55ad63f30f7eb7205b3d19ea4df231414cd0fe23be3daf437815d8c498abb00d8bad86b30adb4a35dfd133a8d19462af88c72292d5c04864b7ee0

memory/1988-56-0x000000000C7B0000-0x000000000C7C0000-memory.dmp

memory/1988-57-0x000000000C770000-0x000000000C780000-memory.dmp

memory/1988-55-0x0000000074C30000-0x00000000753E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/1988-514-0x0000000001800000-0x0000000001810000-memory.dmp

memory/1988-865-0x0000000001800000-0x0000000001810000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/1988-869-0x0000000074C30000-0x00000000753E0000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

98s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\rteth.sys C:\Windows\system32\cmd.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\winconfig.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\winconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4824 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 4824 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 4824 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 1312 wrote to memory of 5068 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 1312 wrote to memory of 5068 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 5068 wrote to memory of 3452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 5068 wrote to memory of 3452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 5068 wrote to memory of 3452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 5068 wrote to memory of 5060 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5068 wrote to memory of 5060 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5068 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3936 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3936 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3988 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3988 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4652 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4652 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4444 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4444 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4184 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4184 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 460 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 460 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3928 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3928 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3280 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3280 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3260 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 3260 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9CCC.tmp\9CDD.tmp\9CDE.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Windows\Temp\winconfig.exe

MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\9CCC.tmp\9CDD.tmp\9CDE.bat

MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:43

Platform

win10v2004-20240226-en

Max time kernel

5s

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3944855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4332-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:45

Platform

win10v2004-20240226-en

Max time kernel

77s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 17.192.122.92.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp

Files

memory/4660-0-0x0000000075290000-0x0000000075A40000-memory.dmp

memory/4660-1-0x0000000000A90000-0x0000000000AB6000-memory.dmp

memory/4660-2-0x0000000005AF0000-0x0000000006094000-memory.dmp

memory/4660-3-0x0000000005490000-0x0000000005522000-memory.dmp

memory/4660-4-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/4660-5-0x0000000005560000-0x000000000556A000-memory.dmp

memory/1184-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4660-7-0x0000000075290000-0x0000000075A40000-memory.dmp

memory/4660-8-0x00000000055F0000-0x0000000005600000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:44

Platform

win7-20240221-en

Max time kernel

2s

Max time network

15s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:46

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240608468.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\240608468.bat

MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/3996-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-02 23:32

Reported

2024-03-02 23:43

Platform

win7-20240215-en

Max time kernel

6s

Max time network

11s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2500-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3028-1-0x0000000002E10000-0x0000000002E11000-memory.dmp

memory/2428-2-0x0000000002AA0000-0x0000000002AA1000-memory.dmp