d32f3a860b863d38f117c2e7efcaa6909583d418f8578b526a7ed0153529644b

Analysis

max time kernel
597s
max time network
358s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Virus Maker.rar
Size

82KB
MD5

d1f61793e7898df4b27e3345764ceca8
SHA1

f03b91146aeaf753b565620a022a238830ed56d4
SHA256

d32f3a860b863d38f117c2e7efcaa6909583d418f8578b526a7ed0153529644b
SHA512

6491767f6db68886d000b173306377f3b0bf2d6db765ce4c14139c9ad09fa44e6cb75489f3858e45c4000333d2ad517721f81cc48e94de25c75c17cac36bb617
SSDEEP

1536:S0s/fG5w2aRBBNACjLkvSrfqAbv0Zarjg5AfDLCNE3Ztg/776X95:5s/+uRBmvMfzrhfbD2NStk76N5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
848	Virus Maker.exe
2248	setup.exe
1948	setup.exe
1404	setup.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Virus Maker.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Virus Maker.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 47 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Virus Maker.exe

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2616	7zFM.exe
848	Virus Maker.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2616	7zFM.exe
Token: 35	2616	7zFM.exe
Token: SeSecurityPrivilege	2616	7zFM.exe
Token: 33	2508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2508	AUDIODG.EXE
Token: 33	2508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2508	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2616	7zFM.exe
2616	7zFM.exe
2616	7zFM.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe
848	Virus Maker.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
848	Virus Maker.exe
904	mspaint.exe
904	mspaint.exe
904	mspaint.exe
904	mspaint.exe
1872	mspaint.exe
1872	mspaint.exe
1872	mspaint.exe
1872	mspaint.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2616	3068	cmd.exe	29
PID 3068 wrote to memory of 2616	3068	cmd.exe	29
PID 3068 wrote to memory of 2616	3068	cmd.exe	29
PID 2616 wrote to memory of 848	2616	7zFM.exe	32
PID 2616 wrote to memory of 848	2616	7zFM.exe	32
PID 2616 wrote to memory of 848	2616	7zFM.exe	32
PID 2616 wrote to memory of 848	2616	7zFM.exe	32
PID 848 wrote to memory of 844	848	Virus Maker.exe	34
PID 848 wrote to memory of 844	848	Virus Maker.exe	34
PID 848 wrote to memory of 844	848	Virus Maker.exe	34
PID 848 wrote to memory of 844	848	Virus Maker.exe	34
PID 844 wrote to memory of 2056	844	vbc.exe	36
PID 844 wrote to memory of 2056	844	vbc.exe	36
PID 844 wrote to memory of 2056	844	vbc.exe	36
PID 844 wrote to memory of 2056	844	vbc.exe	36
PID 2248 wrote to memory of 112	2248	setup.exe	38
PID 2248 wrote to memory of 112	2248	setup.exe	38
PID 2248 wrote to memory of 112	2248	setup.exe	38
PID 112 wrote to memory of 576	112	cmd.exe	40
PID 112 wrote to memory of 576	112	cmd.exe	40
PID 112 wrote to memory of 576	112	cmd.exe	40
PID 576 wrote to memory of 584	576	net.exe	41
PID 576 wrote to memory of 584	576	net.exe	41
PID 576 wrote to memory of 584	576	net.exe	41
PID 1948 wrote to memory of 1228	1948	setup.exe	44
PID 1948 wrote to memory of 1228	1948	setup.exe	44
PID 1948 wrote to memory of 1228	1948	setup.exe	44
PID 1228 wrote to memory of 2304	1228	cmd.exe	46
PID 1228 wrote to memory of 2304	1228	cmd.exe	46
PID 1228 wrote to memory of 2304	1228	cmd.exe	46
PID 2304 wrote to memory of 340	2304	net.exe	47
PID 2304 wrote to memory of 340	2304	net.exe	47
PID 2304 wrote to memory of 340	2304	net.exe	47
PID 1228 wrote to memory of 904	1228	cmd.exe	48
PID 1228 wrote to memory of 904	1228	cmd.exe	48
PID 1228 wrote to memory of 904	1228	cmd.exe	48
PID 1228 wrote to memory of 888	1228	cmd.exe	49
PID 1228 wrote to memory of 888	1228	cmd.exe	49
PID 1228 wrote to memory of 888	1228	cmd.exe	49
PID 888 wrote to memory of 2884	888	net.exe	50
PID 888 wrote to memory of 2884	888	net.exe	50
PID 888 wrote to memory of 2884	888	net.exe	50
PID 1228 wrote to memory of 1872	1228	cmd.exe	52
PID 1228 wrote to memory of 1872	1228	cmd.exe	52
PID 1228 wrote to memory of 1872	1228	cmd.exe	52
PID 1228 wrote to memory of 2728	1228	cmd.exe	53
PID 1228 wrote to memory of 2728	1228	cmd.exe	53
PID 1228 wrote to memory of 2728	1228	cmd.exe	53
PID 2728 wrote to memory of 2592	2728	net.exe	54
PID 2728 wrote to memory of 2592	2728	net.exe	54
PID 2728 wrote to memory of 2592	2728	net.exe	54

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Virus Maker.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Virus Maker.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\7zO83A429E6\Virus Maker.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO83A429E6\Virus Maker.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uq0sx0cd\uq0sx0cd.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F6A250AD12C43E5A7046143FFDBE3.TMP"
        5⤵
        
        PID:2056

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2640

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:584

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:340
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:904
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:2884
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1872
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:380

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Executes dropped EXE
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO83A429E6\Virus Maker.exe

Filesize
3.2MB

MD5
dfd67248a15e45d83c5f7fbb2221ddac

SHA1
23ed3c995437f8fbb198bc68ae5ebda675637b5e

SHA256
f6a92dab6e38f074c056eb155be0097555ca5c3b8a98b0a9697edb0bb2b78aff

SHA512
f8d5b2c75b5894af6dc0579848a7f044d4560d39e3220355153c725b75bf8ef545956e933068f604aebfe1d400bf3bd6451f2ccc52b665212abb091d18d95544

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO83A429E6\Virus Maker.exe

Filesize
3.7MB

MD5
c00845708ee4e6cbaa628a0886076c4d

SHA1
e011d28a40304957961654e62d00754a772fdee8

SHA256
16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092

SHA512
2b6a09b934ad6076008ad1b8bc960b6c3bf39968275f9f46fe1afbed7228eb196b46172c175106da70af80ad78aafc327869e71860af6472c74867dba022fb59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9E71.tmp

Filesize
1KB

MD5
d0c2c8f0be7ef1ccea989d8089f3d7cc

SHA1
5c8a21bf633cc99939c61c908ea716b7469dbc41

SHA256
db56413477e3da765302fda8f2b982bd4d8d09e31cf08c1694c87b33eb2083bf

SHA512
e7c8ec6cf5cce65e32fb05120fe97bb1426c81c93d264adefecd7413ffc2b127b2a0f5069ce17d72e013986fd5b73c536ff7b55cbdf5352a882ce1a8ebc92a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmd.bat

Filesize
633B

MD5
323a0a910110cc2645d39e8096eaefa9

SHA1
5b0d43ecb783e4e53f114b2853e0e85134352516

SHA256
dc2a924f0cc6f2a105861c70cf9f1d83619cbaf6c69283cf0cf03c951537b41a

SHA512
a5d7ebe2f443bc71afd95b35f52cc1da2471390906a6d1b3672b060ed32ede7ef6be6e36ff3ec4f03b04656ca855e6b5c3a7b86afcc2ae928963abee638029b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\uq0sx0cd\uq0sx0cd.0.vb

Filesize
1KB

MD5
7f159f4fb9949412b94c6a570010bf76

SHA1
cb53e9b530f55ed51f878272288bd30cf95bf507

SHA256
6bc1b263d14e51a5a4b96c4be1b4341f9a7ca39715e65cafb7552cc2bd15c90f

SHA512
6d23f6ebf8e85bf3cf7542034b7ba1f3c8537a206ceb1fefd8f97187974b6ee97c69b272aa929026ab3c482d535c6d4df245fa8585ad261a304089093c115b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\uq0sx0cd\uq0sx0cd.cmdline

Filesize
170B

MD5
13fd40fd0950b5f73b8090eea9b92598

SHA1
8c81f302f18dd50f6d4e69485873e79ecd9726cb

SHA256
8d66f6e456a4087d8bdba64749752b87e0bb00baecf36f6f8b53655dacc23a96

SHA512
147465c8883d0f5971427653a02f6df6b90506173f4008f1420ee1dd52642568b5a47cf48e3cc2532c4e37f0e06d1780413286e85e7ba078b432594e96118784

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1F6A250AD12C43E5A7046143FFDBE3.TMP

Filesize
1KB

MD5
8071879382994b1ff8e5e4ce397a4622

SHA1
abc7cb821425ee073e049774416df84529b6cfe7

SHA256
6ec31828c59974e1dd24b258455bd3cecd1e76faa0e9e26c02e659a37b494d46

SHA512
6f71215974e5c42f6f457db0a9901f72017a643c493a8092ece7bf2af8274b0ca12de130985b393ed5e62c4b966d263db738fd08731625c588f5096b7dfa9617

Download Submit
C:\Users\Admin\Desktop\ConvertFromUnblock.ttf

Filesize
380KB

MD5
fcbc64c9d2430f32c9c1280c248d0afd

SHA1
3b1d6c810b633d187b0713852cd283b69cde5ec4

SHA256
c86e7333aa2e13a82ed8ad44e490ffcddcc8f8306bf9e7cf8c922d044da1ac7e

SHA512
fa7e09caabef7f0dc9e7b96698bf7e57f28f066c01c88c60a0eb84b22fd9aada74722a5af121c479c24bc91a8ce29a29c58a1907a1284f28bcbed18b19b1f9ab

Download Submit
C:\Users\Admin\Desktop\DisableClose.mid

Filesize
1.3MB

MD5
25f1095f803f56316ed9bdb2ec042b3c

SHA1
4740111b9403b40dfd4a58eee1aa99652dc76d22

SHA256
3ba173ad6f13f91e4f23a517798d72fe26e12ef7bf25ea04b144d587a832065c

SHA512
afdf370125a5f55e2cbe99f9be0aa89e290daefc59ca33fa1eeaf4a3ac1d1c2df1f1630525a35a2de52964526ac5a882c40194d2172299c1655dbdcc4525b1a0

Download Submit
C:\Users\Admin\Desktop\DisableUnblock.M2T

Filesize
634KB

MD5
628ea346e3314dc9f1ca9bd4fbe0ac90

SHA1
44c1554954de32c8131a24db4ad68ded55901e78

SHA256
c5c91877a01a453d63bceb58ed4f6b6234d3d3c497e1b290f7d2826aca6d3e4d

SHA512
a881227dc599541d7f46b45ad9c3823a37c9299694141e643de11a32420d6f1bd7159569990d7b1ccf39f8e7485c557f91f2b82bbf564632cda2f91292d87399

Download Submit
C:\Users\Admin\Desktop\EditPush.txt

Filesize
571KB

MD5
42936a0ad939ba3371852f66cc874621

SHA1
a39b6b3ce0387c0b3d16c3e96eb3e26f113a838b

SHA256
f238c7a3c4e0790dff5ef0fa62aac0eb505668383b2557b666b105481c6fc2c5

SHA512
c5f15c20fc44a3216cc4b2d893dfdbb13ffaf50abfe7e149814193d1ba9e7bc62a3b471e536196847ca0a0d7432b58f6b1871395e522c563a41c6eaf14098a4c

Download Submit
C:\Users\Admin\Desktop\ExportImport.pps

Filesize
698KB

MD5
89f9bf289750f6e167beab54922bdf8b

SHA1
f9432d25a8472d5f4a6e21f5b669061d5a861a09

SHA256
21ee9dc7d0d8006c9c4ed9bea0e5e25c0cb206ff86567a70788efcbe26869ebf

SHA512
029486e077a5ab49c5849e6bca73d331f62209d009cded16a2d38321fb5ff137c2761f2303e95279a98d820e822cf4e08d0486f6806aac6cd00b563fea91314d

Download Submit
C:\Users\Admin\Desktop\GroupOut.sys

Filesize
888KB

MD5
58e7f9beb3623b610d7e1521abe8749b

SHA1
696ab5ff4e948fe0139ba68305f04f7e9ac4eed4

SHA256
b9bb210436a3253dedab2fde6bf4e112c601192b6b275278ad8e1bd758919f77

SHA512
4c58806b27ca29fd20b9433728b2a7de424545471485c295c13869a9231d14268f8fe52c589bf302c52dbc1273796491591ce9d1498cc002751dcf8909d35df9

Download Submit
C:\Users\Admin\Desktop\InstallHide.gif

Filesize
349KB

MD5
5dfcc1a294b4e333914d757574b19b45

SHA1
4f93dec8888f215d1c624f6140d063fcb312fbb5

SHA256
625664f7bec3adba87a3454d12dfcc65c1dacf21f00b1d5f5747a0653ad0bc3a

SHA512
738ce32ed4af46bd64745e69919fc27c6bfadc0bcc14cefba8e4da774bd95273bd316c090c945eefdf451dba10136578b02fa768f3888f3f01497662488e3e89

Download Submit
C:\Users\Admin\Desktop\LockSkip.ps1

Filesize
952KB

MD5
96cdf97d7626510a0ed0b6de245a65e4

SHA1
578f2849cb7f27b30033520faa0b2245928df608

SHA256
6b2b9545354c4656bc94715154e96899a099e3db6a8ee45b388680c51ee9e8ff

SHA512
6a1e7c262d362c38aa68a3a7513f6de1fb06346340bbf8c4cb280dcbf5250724bbe1c3845f4bbdaf119bafc4491f52be26d45fe287062b20e29ce7b20f5bc1b7

Download Submit
C:\Users\Admin\Desktop\MeasureReceive.mp3

Filesize
842KB

MD5
0ccfb8b225d71a2e4d4da7ae440397eb

SHA1
d1473c62245751822947afc83d0aa3499762bb71

SHA256
969a74bdc42b788e785dc6d29605c7b2d2c4564e15258eda3c2ceea037eceaf2

SHA512
1a2f0bc16fd82a99e7055149c23ff7732fd541adcb5eec716b74a865bc50ab883ba7f6feaed67764c53977ff99efbdc19f1b67e7200415b0392520817f9ccea0

Download Submit
C:\Users\Admin\Desktop\MergeRevoke.mp3

Filesize
476KB

MD5
80a8125d58336b3fbaf1099236dbfac5

SHA1
d3e502504d9f71d0675e8079f07b785ba575ece8

SHA256
218d956ffadae00d686b93fbd26eeb37d3ea78a7a1daa5c451aa9d86b2d0ef1e

SHA512
6ba2b4affd959d074426e72c2ab3d8571f2d04527a729d1a7dab4724da6eeefc6a2a627fd82b2e4894424dd3ffb16598e54433a6898921c3782b6816202b1414

Download Submit
C:\Users\Admin\Desktop\OpenRead.mp2

Filesize
660KB

MD5
194fe5f65bdd7e98a01f583a5f78737b

SHA1
ad5078255b9ded67f3aae7c2a3e9a44aa3609a3f

SHA256
1b3ec98e5228235fbc0c7a937fe2a181424d7c8e039fbee455f94090a7990d40

SHA512
d2156d648738c31b36c02636356645a4173591fcc12e136b8fa2a96bc57f5a4bbc7338876902273c23f33a1ad56a073e0a27161e274da0bee110798070a43428

Download Submit
C:\Users\Admin\Desktop\PushRegister.bat

Filesize
544KB

MD5
b496013654ffa6887197b736ae5e93ce

SHA1
318081cf2264885d6b6cc5f0b27b6c7485b6ce43

SHA256
b4219f5b83a689f2db607ae6dde662b2391f47b3bf47d8b3e0e3a4af617260c4

SHA512
85d4a6f33ae94ea2759c773586853c83d53799156bbce776a4e13954298f9254a6b579c79aa839e08e3fbcf54ca134eb5e6d6bc35603c6a98fdf7e52477b1bea

Download Submit
C:\Users\Admin\Desktop\RemoveDisconnect.wma

Filesize
602KB

MD5
b8cebd1753581109c34fa83ea323d19e

SHA1
4b302190aa672629674122a0389977d892fcf5a9

SHA256
21134e6b008816f2bfe86ca6f47f96966f8c3355da5e32a9b94f4487e9f4f391

SHA512
c77a11e4778766d7f7346bf2e6d276152fe5d59ea8815cc5166731e66c4c0c8277d75f6cb5ce567709f45725a2a83d0ce9c0099ddf05b32756257e47b2de9560

Download Submit
C:\Users\Admin\Desktop\ResolveOut.cmd

Filesize
761KB

MD5
3f86a177e82316bb4819d1eb97db5201

SHA1
2771451d1232ce6179a0783e0693151b310b9837

SHA256
0e104a75f8b13b18c394f1c1a21d86af06be82f2dd8c026446bf0b3ddd432b96

SHA512
985e2a7864f835476e29c7459e24f9d149a2bd7a558ac71b4b00dc6cb725c63aaae579ffd9d7c2f067fa408742dd74b9a372b35c9780e0ce1d8acdb1339af5b2

Download Submit
C:\Users\Admin\Desktop\RevokeUndo.zip

Filesize
793KB

MD5
b4103f1b00e0b7f882f169a0fd16df4a

SHA1
7153afedb70e0e18f8fc9137be48b208cb8f8a1a

SHA256
2303d2bd14f782a494e41aa70395f9aab4a0740633a98ab1c6b5463b207a1eb2

SHA512
a5d96abfdfbb68eeef08abb237c5f2a6faca113e27fb12dee75d6950ab55b383a7e681e40351cbed7b969989244a78a0d59869a22e539687ce836fde01219b66

Download Submit
C:\Users\Admin\Desktop\StopApprove.pptm

Filesize
444KB

MD5
1c29df8bf76edf743fe0eb7162220a27

SHA1
b752745f307091c2b2ad50e922a2efce84d12c0a

SHA256
e8cddedb7e1b95560ab1b76aa12e08e3d3996b82584736f7dce3f12b926c6b6b

SHA512
de68d1d281101982c07bcd65685172e3a74ffc3affa2fb98b244957974aa9914e565e94a3afb95c76cf5e37846af7d35e30339a7b2219754ec2ad07813b254f5

Download Submit
C:\Users\Admin\Desktop\SyncRemove.vsx

Filesize
539KB

MD5
352d81c43717dc189d6a179988a3af13

SHA1
e39c4a7d9c88fc402356cee5997f664e59bfa662

SHA256
c09f5c7236229a477943f53df74f13bfaeb2634861107567d2e98a1185cea6ef

SHA512
32aab7d361752fb97982e1b95266f325c2b09504e1b016bbfd02ea2c7d4e57e306235abbe31c2b9213b924edce09a662d58e10c03853bc5a7c5aaecc4f3afb3e

Download Submit
C:\Users\Admin\Desktop\UndoSync.docx

Filesize
729KB

MD5
abb5a30364538cb13b17427a9e4c16d6

SHA1
e502ce3f3d10a53736423c6c3cfddab677be2379

SHA256
c2546dc9e3598ae5e0c98f03e451017348226e07eec09474360c6af1ad892b08

SHA512
ea4d525364ff3dabccce2ffbff4f0dd93d0dd3bdda37dd4b49c38f4b0dbdf6808c386ebf00d860256ebf6804fff5358fcb70427292c98546765437ba1ad9da1b

Download Submit
C:\Users\Admin\Desktop\UnlockGet.wvx

Filesize
507KB

MD5
6d499dcd1e4b8a9d95b2f528ace25a6c

SHA1
e2ba7f40e740eccb0142e3b5e8dd9fb68de979b8

SHA256
e195e67b9cb6a848b15c9bf07d55e5ec66bbd4e2118d1eec48d271a8d25f6c3d

SHA512
f99c2e6c52ff12e9d51605878340467609e7afd2b58bb02efdc4df849fec7a66147df9f6fbd75d389290aab3dbe7fe197c8b22a0ce6adbbf31f2699972ae0b74

Download Submit
C:\Users\Admin\Desktop\UpdateRead.jpe

Filesize
412KB

MD5
2a3c076c3d881b960f275a235fa02005

SHA1
9b1198fb27d984db8e18d2e2d885feece8017f06

SHA256
224bc4a82e6ea1934a75afb10e3f6b663c45065044900a38edf94fd321695a10

SHA512
2f604c44fc9b440d2076c6e595f824001481ca92a1e6022f6632a9f3b7571b470cc4fb097abdc074c3b08f1158a2701e8bf8829e1f7745e0e79adfb6aff27658

Download Submit
C:\Users\Admin\Desktop\UseWatch.vbe

Filesize
825KB

MD5
c41f76c11226103a9f7c9cf5f18715f3

SHA1
8896dd3ace2fbb3b58ead2c99bf7df205f15f5cb

SHA256
7a65deb574484807aa8dfc6a7455fe506e5cb35f6271a8fd7c314c3dc0926874

SHA512
f910cb9eb89d069716c6a4042e3f56f9eea47c0e7a057b3b2ad94830fb7ac1267d5214c4e4b9d2c01712ea186f39a231a7d85fb84ae8f6335d600d22d319f30c

Download Submit
C:\Users\Admin\Desktop\setup.exe

Filesize
8KB

MD5
9e41f4387671141dfc89b9fa6b504ee6

SHA1
a676e2acb94f6a48e9738ff37189883a7514859b

SHA256
80682a6f90bf1faf31da61c16e0fb844075e289d4ad226a491674a9650672a51

SHA512
83c124c9104adc358cdb589d7001019613432c84fabf81e4343ade05d80f40e610058df6241ac68f0762ef727e2406d9a64440d070c4e6a12bcd57f0c994b990

Download Submit
memory/848-46-0x0000000008D70000-0x0000000008D72000-memory.dmp

Filesize
8KB

Download
memory/848-75-0x0000000008D00000-0x0000000008D01000-memory.dmp

Filesize
4KB

Download
memory/848-37-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/848-63-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/848-36-0x0000000000120000-0x00000000004CE000-memory.dmp

Filesize
3.7MB

Download
memory/848-38-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/848-45-0x0000000008D00000-0x0000000008D01000-memory.dmp

Filesize
4KB

Download
memory/848-44-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/848-43-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/848-42-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/848-39-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/848-41-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/904-97-0x0000000003E70000-0x0000000003E71000-memory.dmp

Filesize
4KB

Download
memory/904-93-0x000007FEF6320000-0x000007FEF636C000-memory.dmp

Filesize
304KB

Download
memory/904-94-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/904-98-0x000007FEF6320000-0x000007FEF636C000-memory.dmp

Filesize
304KB

Download
memory/1872-101-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/1872-100-0x000007FEF6320000-0x000007FEF636C000-memory.dmp

Filesize
304KB

Download
memory/1872-102-0x000007FEF6320000-0x000007FEF636C000-memory.dmp

Filesize
304KB

Download
memory/1948-91-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/1948-89-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-76-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-73-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-64-0x0000000001060000-0x0000000001068000-memory.dmp

Filesize
32KB

Download