zgrat | 05f9a6b8d512fc86ad39a503a4b82385b04b274c10d8260135d3babeefa8abea

Analysis

max time kernel
78s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
BoosterX2.0.rar
Size 9.1MB
Sample240302-sc86haef93
SHA256 05f9a6b8d512fc86ad39a503a4b82385b04b274c10d8260135d3babeefa8abea
MD5 30f16376b4d940673d31ef43a40adf98
SHA1 5aa69c1e1928d41539dc2b6900a2fd223b6eaba9
SHA512 600807d81457108379ec500c289de93069f1a4b5242110576e5f5502caf0f1b2661ba7f4c9de7dd5066cf3f82a7730054bf3189aac8813727952824564a83139
SSDEEP 196608:6cuGDnBvSyJBhmSo4zYvp9KlTKHUZwkD5XCDnnIIQVUOyxokK:6RGDnBvBO4cKKUmkDQTIIQVey9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat persistence pyinstaller rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023264-48.dat	family_zgrat_v1
behavioral2/memory/2456-55-0x0000000000B40000-0x0000000000DD0000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\fr\\WmiPrvSE.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\fr\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\csrss.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\fr\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\fr\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\", \"C:\\ContainerwebFontruntimeMonitor.exe\""	ContainerwebFontruntimeMonitor.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	3524	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	3524	schtasks.exe	104

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	BoosterX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ContainerwebFontruntimeMonitor.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ContainerwebFontruntimeMonitor.exe

Executes dropped EXE 6 IoCs

pid	Process
2744	BoosterX2.0.exe
2656	BoosterX2.0.exe
2524	BoosterX.exe
3380	ContainerwebFontruntimeMonitor.sfx.exe
2456	ContainerwebFontruntimeMonitor.exe
3052	ContainerwebFontruntimeMonitor.exe

Loads dropped DLL 2 IoCs

pid	Process
2656	BoosterX2.0.exe
2656	BoosterX2.0.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ContainerwebFontruntimeMonitor = "\"C:\\ContainerwebFontruntimeMonitor.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ContainerwebFontruntimeMonitor = "\"C:\\ContainerwebFontruntimeMonitor.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\MsEdgeCrashpad\\reports\\RuntimeBroker.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\fr\\WmiPrvSE.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\fr\\WmiPrvSE.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	ContainerwebFontruntimeMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\""	ContainerwebFontruntimeMonitor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCB55BF721368848AD8F5766BAD82B217.TMP	csc.exe
File created	\??\c:\Windows\System32\_iyiwy.exe	csc.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe	ContainerwebFontruntimeMonitor.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe	ContainerwebFontruntimeMonitor.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC909910AAB01E4CF489C563F5978FA0A6.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	ContainerwebFontruntimeMonitor.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\WmiPrvSE.exe	ContainerwebFontruntimeMonitor.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\24dbde2999530e	ContainerwebFontruntimeMonitor.exe
File created	C:\Program Files\MsEdgeCrashpad\reports\RuntimeBroker.exe	ContainerwebFontruntimeMonitor.exe
File created	C:\Program Files\MsEdgeCrashpad\reports\9e8d7a4ca61bd9	ContainerwebFontruntimeMonitor.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000800000002325e-3.dat	pyinstaller
behavioral2/files/0x000800000002325e-17.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2156	schtasks.exe
4904	schtasks.exe
2496	schtasks.exe
680	schtasks.exe
1272	schtasks.exe
1020	schtasks.exe
4104	schtasks.exe
772	schtasks.exe
2340	schtasks.exe
2556	schtasks.exe
3480	schtasks.exe
4804	schtasks.exe
3264	schtasks.exe
4664	schtasks.exe
1116	schtasks.exe
5100	schtasks.exe
4436	schtasks.exe
2152	schtasks.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	ContainerwebFontruntimeMonitor.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4368	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe
2456	ContainerwebFontruntimeMonitor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
528	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	528	7zFM.exe
Token: 35	528	7zFM.exe
Token: SeSecurityPrivilege	528	7zFM.exe
Token: SeSecurityPrivilege	528	7zFM.exe
Token: SeDebugPrivilege	2456	ContainerwebFontruntimeMonitor.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
528	7zFM.exe
528	7zFM.exe
528	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	LogonUI.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 528	2416	cmd.exe	94
PID 2416 wrote to memory of 528	2416	cmd.exe	94
PID 2744 wrote to memory of 2656	2744	BoosterX2.0.exe	108
PID 2744 wrote to memory of 2656	2744	BoosterX2.0.exe	108
PID 2656 wrote to memory of 3436	2656	BoosterX2.0.exe	109
PID 2656 wrote to memory of 3436	2656	BoosterX2.0.exe	109
PID 3436 wrote to memory of 2524	3436	cmd.exe	111
PID 3436 wrote to memory of 2524	3436	cmd.exe	111
PID 3436 wrote to memory of 2524	3436	cmd.exe	111
PID 2524 wrote to memory of 3976	2524	BoosterX.exe	114
PID 2524 wrote to memory of 3976	2524	BoosterX.exe	114
PID 2524 wrote to memory of 3976	2524	BoosterX.exe	114
PID 3976 wrote to memory of 3380	3976	cmd.exe	116
PID 3976 wrote to memory of 3380	3976	cmd.exe	116
PID 3976 wrote to memory of 3380	3976	cmd.exe	116
PID 3380 wrote to memory of 2456	3380	ContainerwebFontruntimeMonitor.sfx.exe	117
PID 3380 wrote to memory of 2456	3380	ContainerwebFontruntimeMonitor.sfx.exe	117
PID 2456 wrote to memory of 1928	2456	ContainerwebFontruntimeMonitor.exe	121
PID 2456 wrote to memory of 1928	2456	ContainerwebFontruntimeMonitor.exe	121
PID 1928 wrote to memory of 4976	1928	csc.exe	123
PID 1928 wrote to memory of 4976	1928	csc.exe	123
PID 2456 wrote to memory of 2392	2456	ContainerwebFontruntimeMonitor.exe	124
PID 2456 wrote to memory of 2392	2456	ContainerwebFontruntimeMonitor.exe	124
PID 2392 wrote to memory of 4928	2392	csc.exe	126
PID 2392 wrote to memory of 4928	2392	csc.exe	126
PID 2456 wrote to memory of 2892	2456	ContainerwebFontruntimeMonitor.exe	142
PID 2456 wrote to memory of 2892	2456	ContainerwebFontruntimeMonitor.exe	142
PID 2892 wrote to memory of 4668	2892	cmd.exe	144
PID 2892 wrote to memory of 4668	2892	cmd.exe	144
PID 2892 wrote to memory of 4368	2892	cmd.exe	145
PID 2892 wrote to memory of 4368	2892	cmd.exe	145
PID 2892 wrote to memory of 3052	2892	cmd.exe	151
PID 2892 wrote to memory of 3052	2892	cmd.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BoosterX2.0.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BoosterX2.0.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:528

C:\Users\Admin\Desktop\BoosterX2.0.exe
"C:\Users\Admin\Desktop\BoosterX2.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\Desktop\BoosterX2.0.exe
  "C:\Users\Admin\Desktop\BoosterX2.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI27442\BoosterX.exe -p1234
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\_MEI27442\BoosterX.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI27442\BoosterX.exe -p1234
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\1.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3976
      - C:\ContainerwebFontruntimeMonitor.sfx.exe
        
        ContainerwebFontruntimeMonitor.sfx.exe -p1234
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\ContainerwebFontruntimeMonitor.exe
        
        "C:\ContainerwebFontruntimeMonitor.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2sceuhsi\2sceuhsi.cmdline"
        8⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBAEE.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC909910AAB01E4CF489C563F5978FA0A6.TMP"
        9⤵
        
        PID:4976
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0sz3x5ri\0sz3x5ri.cmdline"
        8⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC85.tmp" "c:\Windows\System32\CSCB55BF721368848AD8F5766BAD82B217.TMP"
        9⤵
        
        PID:4928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bXRcL4agDZ.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4368
        
        C:\ContainerwebFontruntimeMonitor.exe
        
        "C:\ContainerwebFontruntimeMonitor.exe"
        9⤵
        Executes dropped EXE
        
        PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\MsEdgeCrashpad\reports\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MsEdgeCrashpad\reports\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\MsEdgeCrashpad\reports\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ContainerwebFontruntimeMonitorC" /sc MINUTE /mo 14 /tr "'C:\ContainerwebFontruntimeMonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ContainerwebFontruntimeMonitor" /sc ONLOGON /tr "'C:\ContainerwebFontruntimeMonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ContainerwebFontruntimeMonitorC" /sc MINUTE /mo 5 /tr "'C:\ContainerwebFontruntimeMonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa396b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\1.bat
Size 64B
SHA256 824a47b86cc017dbd25c246c96723977684a7111ca52e88ce1f6eecfcdea17e9
MD5 d3dc0d32ff35a295526830d74156612c
SHA1 5105d317b531dd8b6fe39b6bd9048703baa9ecfa
SHA512 60c4cb03014f6060584465a1640574da91f38af2c0f221cfa8fc72f9436da329bfc5a6d5b839fe85ead0c63e28e96a40513879adaed12ce9528afcef9ce94dfb
MD5 SHA1 SHA512

Submit Download

ContainerwebFontruntimeMonitor.exe

Path C:\ContainerwebFontruntimeMonitor.exe
Size 2.5MB
SHA256 2f7d33d59695a95f53f8f70aabb20aee789ec183b3ecfc697b2d96ff75503f8c
MD5 ce2872e50e778c0b14536e10f5739196
SHA1 de65d5349f2b34f92067d99ecaf987b383b31d80
SHA512 9fbcd38424862479274494c59335899746415d4171febadb7e707643bbfbbdf627f915edf98b1c577d19427cbe8d048c8fffe4aeeac07f01d2e27ec3891254ef
SSDEEP 49152:8A9TblH+dVIW+p+7r7k0Ausgg+1o5mJhJGE1ujzMRBH:8A9gTF379Aujg+1o5CJGE1uje
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContainerwebFontruntimeMonitor.sfx.exe

Path C:\ContainerwebFontruntimeMonitor.sfx.exe
Size 2.4MB
SHA256 80ccf6d03a36f32419b154f2a69d49eda23d2de596ae6e152bff01d5b1f3014d
MD5 d66300071e1b8edb41a66e3e915e6902
SHA1 f7cbd5038bce84a3ed69abc388f24280a527113c
SHA512 9159b1050db04d3a9e3336cae3cc7e465b486085b51474b20be712fee06a7d952aba5ad40905fdf6a7501422c8129d46e580cc49b38d2464e442f54973431f11
SSDEEP 49152:FsvMEJeFgC9C6bPCukYCo5FyXPBmm9F7q+C1+BqUVUKKw:FskiZWLCJYLYBbsNgBqRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESBAEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBAEE.tmp
Size 1KB
SHA256 d893abffe5885e91ff26338bc842c997bbfe63f838e5d864fde0ae642ff1682f
MD5 418c0dd409105a26c6db5d304688f988
SHA1 069941d27e3a36eb5f36d9a3d24bb8ecbc6550f4
SHA512 818ba2b32ff5ca834ce6418d9b14fb02f2662dd7649d2b2e1100814c5f2f809bb0d5c2c4cef9d53e357ba4b1800f219d0339b77ceb756517a342cd7ab8af9c60
MD5 SHA1 SHA512

Submit Download

RESBC85.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBC85.tmp
Size 1KB
SHA256 58aba08b5994c2ea68d0c3fbf30d60130529ae3d12e0a4c62aec3c1f0a8868b2
MD5 cf698a7602c8e93f13475095741e2654
SHA1 0d6d28109adac78b131999ec1dd60a2e0312b705
SHA512 62eeeb243a5f3a7a33cd52a74c673754cedbfa1a761a29862b30998dfd534d7c876c7335b1fed8df21e1aae633606266bcce939579264f8e1a639b3927774ae9
MD5 SHA1 SHA512

Submit Download

BoosterX.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\BoosterX.exe
Size 551KB
SHA256 5d1fc31cc5b87a4e5c18a6c4adbdcf2d437ca76510a060c298339375135f502d
MD5 1be5bf7c43f227945dcc47cb01059f14
SHA1 0e90b194acf818512fd33d9e75338f3d7c514d9a
SHA512 93357c6d2640252b9ca69d5eb1c6241eb45419bf35bb2e581a04a3a5bccad060261b7f00e271dedcbea8193ab794e162d8b1d34f30344fb51a52bab84976fca6
SSDEEP 12288:jBdlwHRn+WlYV+8T+tkuf17/b6iUrgWEeXSYz:jBkVdlYAKufIiUr1EcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\BoosterX.exe
Size 2.6MB
SHA256 ac659db2f32109eb45b54ecd51e8daa4ca2ae7dd2ff0ac8b6cf1931f1c8d6ae7
MD5 5e36b701915036b7b7aa5d7952a5ddc3
SHA1 b3b7a0a9b0184eeed0d95ccba33bc4204bc9f60a
SHA512 cac6d6b7fc3306a129e397a98ea262329adf7376bbd7d9916cbe7d9dc66c5f99505883f4da025fbbfac2c78b36c52316630569b44c3e56145149163e10be852b
SSDEEP 49152:FsvrfIZOnWAEVyY4uhUsNFTW/YkXQ4AY3XCHXqgxqp+9cn2SAzoX0:FszILAFY4ns/TW/PAiX6XFqp+9Fhok
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_decimal.pyd
Size 247KB
SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
MD5 21c73e7e0d7dad7a1fe728e3b80ce073
SHA1 7b363af01e83c05d0ea75299b39c31d948bbfe01
SHA512 0357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390
SSDEEP 6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\base_library.zip
Size 639KB
SHA256 8c98636ba175345083c3550a5627976e7ef1942a9652964e0ddc9fca20ddc386
MD5 9f4a306a6f648f0a4d7db1da60766bcb
SHA1 fcee7e54c4563a814497ce3a0466325a5f79e1ee
SHA512 9a4a34b23cf81125415b17ecca4f21bd17748d935b780e7c045fd26247fc1d4fbf754a5fc37726636cf316aadf8f687816c2fabaa8eb1c87d42172684b902e5f
SSDEEP 6144:X+ttcY+blWFOYmZOMki94SOOmVHi22FkUa4hQmyZ+N16CEcphzt92nFs+dB7EMbl:uttcY+b+vOmgRF1+fYNXPh26UZWAzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\libcrypto-3.dll
Size 393KB
SHA256 e566ca04ee48d2ef16a310681acdcc9ff27910e163279f3c8834f37a1947de34
MD5 bb5e16cdc465d892d92fc553de79e7d5
SHA1 cf9912aad8366217002d8f0679fde9e319b49ff3
SHA512 e04533a691314c3396a6b530650f1dad03e87d7d73dfb5dd3bd17d03e5171a636ab656dd6fd10a7f8ce02915438cc91e3580266c4a610325a236822453aab3ce
SSDEEP 12288:5mKaurTKuk2qcWhPAIttY3reTjD06MlN/:JTKuk2IPAVIH06i/
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\python312.dll
Size 1.4MB
SHA256 8a8da78efed48fa3fec018396cc71a64342bdec378e5bd2723b64f3d226360fc
MD5 bdedd2182ffdae01f64ba47ea1a46aa5
SHA1 492a473ea44353331a23d233e99b27b077ae399f
SHA512 5d30bd72d0001be5bfeafaaf2af61fa63af58230e593ee675456522c01a1cffea7bca89a660a6d754065a58a5bdf5c18832cc8b0dc61771e4c1378a90a842305
SSDEEP 24576:Uit0m1LL3knN0ze1WzRaIa7dstktY13wBXWHJISzUD10WYXEXb6:Uit0mhL3kezRzRaIa7dsmtY1gBmHJISF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\python312.dll
Size 4.2MB
SHA256 c43a9324c458abc647e6123364b200cfcb7542f4385cd47889da15f5ba2d05d1
MD5 2e56574de1c762ed1e258e7097f44446
SHA1 e0f0c97f96d135378c0b13234ca9c87b31c08b86
SHA512 8f2282903708020c41a0e70d9bf296c2416fcf6cae45a4bc58d2b436c5bdc6a4b1acd881bf2c22cc27f423b0ebc7bba40095fe40b1d10bde40fdebd23929d3fa
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPu:8vwRHTSVlfJVmi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\unicodedata.pyd
Size 348KB
SHA256 0a7b9d207ec9e0195c39e4c9d2997ceb231556a95b556baccbfc135bce33d97c
MD5 92845c0c7cef0a6c58c5e5a50e03b8a4
SHA1 ac7edfe53dc781329486ef97cb8613b2d54f1f83
SHA512 d16bebcd7b9fcdcd7beec4205320b5fa631b02741a2cb5807200caa542bbf788be62983779fc0d8899f7d66156a2403f7d27a292e9cd937186c29cce065fdcce
SSDEEP 6144:F+FrUvxldNGM6TFb/xDCzjfR43HXV4vGZ94ndUqIOGpDCWf:IFrEHdcM6hbZCjJ43w9hIpCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bXRcL4agDZ.bat

Path C:\Users\Admin\AppData\Local\Temp\bXRcL4agDZ.bat
Size 165B
SHA256 f55402b0665e7fdbc559bf2a94a6c7c8730ed6a98472221a00961219db94fa62
MD5 4a746e0c29fcd7d9d5ac48ba0bc45463
SHA1 c75e542615401dbf3e87b6f35d829b3f818b7bfc
SHA512 5a21cf867f63e5a79e5d939ca835f94a0c513bce339d3fe84020c24922076f598654a2aa9e1e6d67ee548541b880cea47eaec3d99e6f99c17a84e5b9ad416f51
MD5 SHA1 SHA512

Submit Download

BoosterX2.0.exe

Path C:\Users\Admin\Desktop\BoosterX2.0.exe
Size 839KB
SHA256 5de8129affd350d82a97951d3230ee683ded5e88dba61caca2a165d2a913059f
MD5 fc88322c4bd942dd92609a9c50b7fec3
SHA1 fc7207ae2cd54522d789cca3442fc15fd2c25d7b
SHA512 79debf6ba0095988801adf2178ef81acc49c62f8d4d4456e43290dd8d571b66db572c028b94a99a48f0a1d757f4a5194104b7254ab2b221be994c702ffe4d1d1
SSDEEP 24576:bDAFXcbIpnqa1C2ETSjvf+m8L54ACKS9ERqnH:bv2qawhSLf+vKjKAERqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path C:\Users\Admin\Desktop\BoosterX2.0.exe
Size 9.3MB
SHA256 3cba06acd8ede78a16f020760e7305af7587cb5c02406ffadaef4da8f5c39ed9
MD5 fceeb96d1bbe68ee5599eae28b89db10
SHA1 06f51414ff0e9cc9e9f14dd1e04bbf49bd935edf
SHA512 6abb3f3abc878176605e21c7304fae360d036489277f52487958b8c1897c067c2e1576da2db5abb4be1a7375b0ef7e95605f2f30377edc3e098128d8e3c2f5e5
SSDEEP 196608:zV6+ZAr3pGRgb7y5jIexH1W903eV4Q+tpDjIIAcwD0RPdvvk9LIL:/qp0gq5McW+eGQ69jo06k
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC909910AAB01E4CF489C563F5978FA0A6.TMP

Path \??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC909910AAB01E4CF489C563F5978FA0A6.TMP
Size 1KB
SHA256 e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f
MD5 b5189fb271be514bec128e0d0809c04e
SHA1 5dd625d27ed30fca234ec097ad66f6c13a7edcbe
SHA512 f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e
MD5 SHA1 SHA512

Submit Download

0sz3x5ri.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0sz3x5ri\0sz3x5ri.0.cs
Size 374B
SHA256 d1b2918918ee36351a12cdbe0f23e5d71313ebc79a3d566fe3d2a4b603f510dc
MD5 41a17134a86cd5a7b5328a3e7af02cdc
SHA1 9814c58be5ca0c3f02b5ee5f4e0e625c5650b1f4
SHA512 e4352a8a1a15dd36868fc0e1258c14bf288ab69e9c3b63fba1f40b26e5a1edd06b1fef56de2d73842c8f9ec00c0dd3e03cf289db92c0a6334194a7ecb50ea7b1
MD5 SHA1 SHA512

Submit Download

0sz3x5ri.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0sz3x5ri\0sz3x5ri.cmdline
Size 235B
SHA256 d058546ab3949a95673e1aa106c747852784873912f90d2b5a747d7f884d553c
MD5 b8f857682462ecc0531f3ff827f13ebf
SHA1 a3a3bba98c00d1d8778ed2abe8828fa9494be315
SHA512 422595075f3bd840aed9a3149486fb90a109fdeb3a107e1e6f846308cf23a52db1ede718c3fe781defba2debd1e8779061c9843c69e9e29d81617218e1e7670e
MD5 SHA1 SHA512

Submit Download

2sceuhsi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2sceuhsi\2sceuhsi.0.cs
Size 404B
SHA256 4598c079b044e8a413c9d3f304c1d7398adf58f89b25773cd9c5d4ab42c0f456
MD5 d20f3f38e0737502e0b842df06b875cb
SHA1 77379d9bd4b5afa04312960903478b61f574a77d
SHA512 dff24508b9f13b12b471f3b855286b4f6520fa9a851e311748afd7d06c6e4b4c9079867b7197698309bec26c409834fe32a7f185e6ac5557bd6b041805d8014e
MD5 SHA1 SHA512

Submit Download

2sceuhsi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2sceuhsi\2sceuhsi.cmdline
Size 265B
SHA256 233de73eefbfbd4fd4398f7bc6f80d067074cd7e458d8faf7aaf15b2c6f5d6dd
MD5 7fcda647b329b860abfe61c5a8ba5dae
SHA1 0bd2637e0be9a3c0cbb22876b1c5cd9420cc16e5
SHA512 ed9660972884f25f99839a0f5d03c846bbe5f84b19a90a3e68dc9590c49fbec9397a5a854b64cc8d8b050687a9dfc43a961a3dd70d598517bf7115fa94d4cf1f
MD5 SHA1 SHA512

Submit Download

CSCB55BF721368848AD8F5766BAD82B217.TMP

Path \??\c:\Windows\System32\CSCB55BF721368848AD8F5766BAD82B217.TMP
Size 1KB
SHA256 1bf68148c555d0e84720c497dcf3ad708da300ee7472df12c9307a3acd4abde1
MD5 188249e3f31caa0264351fc374794895
SHA1 323a707d1a37ac8cbae6d6e502cc850f69ae2e15
SHA512 28a0d97e83b6b6d10c0114166e8f23845663a34c8f262aa5a31ffb885abe232badb6f95bba99b8688559cac81f8ff93c3609ac363d8903d35f535d7c5e1e02d5
MD5 SHA1 SHA512

Submit Download

memory/2456-71-0x000000001BA20000-0x000000001BA38000-memory.dmp

Download

memory/2456-93-0x00007FFEC9BD0000-0x00007FFEC9C8E000-memory.dmp

Download

memory/2456-66-0x00007FFEC9BB0000-0x00007FFEC9BB1000-memory.dmp

Download

memory/2456-69-0x000000001BE90000-0x000000001BEE0000-memory.dmp

Download

memory/2456-72-0x00007FFEC9BA0000-0x00007FFEC9BA1000-memory.dmp

Download

memory/2456-65-0x00007FFEC9BD0000-0x00007FFEC9C8E000-memory.dmp

Download

memory/2456-74-0x0000000002F00000-0x0000000002F0E000-memory.dmp

Download

memory/2456-77-0x00007FFEAABE0000-0x00007FFEAB6A1000-memory.dmp

Download

memory/2456-76-0x000000001BA60000-0x000000001BA72000-memory.dmp

Download

memory/2456-78-0x00007FFEC9B90000-0x00007FFEC9B91000-memory.dmp

Download

memory/2456-79-0x00007FFEC9B80000-0x00007FFEC9B81000-memory.dmp

Download

memory/2456-81-0x0000000002F10000-0x0000000002F20000-memory.dmp

Download

memory/2456-82-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/2456-83-0x00007FFEC9B70000-0x00007FFEC9B71000-memory.dmp

Download

memory/2456-85-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/2456-86-0x00007FFEC9B60000-0x00007FFEC9B61000-memory.dmp

Download

memory/2456-89-0x000000001BF40000-0x000000001BF9A000-memory.dmp

Download

memory/2456-90-0x00007FFEC9B50000-0x00007FFEC9B51000-memory.dmp

Download

memory/2456-87-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/2456-68-0x000000001BA00000-0x000000001BA1C000-memory.dmp

Download

memory/2456-92-0x000000001BA50000-0x000000001BA5E000-memory.dmp

Download

memory/2456-94-0x00007FFEC9B40000-0x00007FFEC9B41000-memory.dmp

Download

memory/2456-96-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

Download

memory/2456-97-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/2456-98-0x00007FFEC9B30000-0x00007FFEC9B31000-memory.dmp

Download

memory/2456-101-0x000000001BEF0000-0x000000001BEFE000-memory.dmp

Download

memory/2456-99-0x00007FFEC9B20000-0x00007FFEC9B21000-memory.dmp

Download

memory/2456-104-0x00007FFEC9B10000-0x00007FFEC9B11000-memory.dmp

Download

memory/2456-103-0x000000001BF00000-0x000000001BF0C000-memory.dmp

Download

memory/2456-64-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/2456-63-0x00007FFEC9BC0000-0x00007FFEC9BC1000-memory.dmp

Download

memory/2456-62-0x0000000002EF0000-0x0000000002EFE000-memory.dmp

Download

memory/2456-60-0x00007FFEC9BD0000-0x00007FFEC9C8E000-memory.dmp

Download

memory/2456-59-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/2456-58-0x0000000001670000-0x0000000001671000-memory.dmp

Download

memory/2456-57-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/2456-56-0x00007FFEAABE0000-0x00007FFEAB6A1000-memory.dmp

Download

memory/2456-145-0x00007FFEC9BD0000-0x00007FFEC9C8E000-memory.dmp

Download

memory/2456-55-0x0000000000B40000-0x0000000000DD0000-memory.dmp

Download

memory/2456-147-0x00007FFEAABE0000-0x00007FFEAB6A1000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads