6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
52s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Trojan/2repair.exe
Size 10.2MB
Sample240316-sns9esdf21
SHA256 327e9f126a7d897239ddafc8adbae981e6a4c00d4d3383846ceb8d2befefef04
MD5 795d891f34890796120931c1b74318a4
SHA1 9a698435df1e850479f66b08dd8ee84e7473b0eb
SHA512 77234732395eac75687aeff81d40fc3e7b1f1d7e14b4df9f786f0aa7cc2bee04d5614dbd6cdd04fd310ea455c2747cd2c0a598143a886807e690c2cc01b06aa0
SSDEEP 196608:LgOzUNRd/74b/Mqe9NPnjRs6j+2ufWvi2DuFg3k7bwanYP9UX5hT84jWR/B:CRd83Klji52RhwPA92584jmB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit evasion persistence trojan upx

Malware Config

Signatures

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	antivirus-platinum.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral19/files/0x000600000001cdb7-183.dat	acprotect

Executes dropped EXE 26 IoCs

pid	Process
324	Melting.exe
768	AntivirusPlatinum.exe
1208	Process not Found
2728	302746537.exe
1760	antivirus-platinum.exe
1656	Antivirus.exe
1392	runaway.exe
1520	runaway.exe
2472	runaway.exe
3032	runaway.exe
2284	Badgame.exe
2580	runaway.exe
2992	runaway.exe
1840	runaway.exe
1976	runaway.exe
3024	Hydra.exe
1824	runaway.exe
1140	runaway.exe
2132	runaway.exe
692	runaway.exe
1044	runaway.exe
996	Melting.exe
1988	runaway.exe
888	runaway.exe
2252	runaway.exe
600	Melting.exe

Loads dropped DLL 3 IoCs

pid	Process
2476	cmd.exe
2476	cmd.exe
2476	cmd.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral19/files/0x000400000001cf93-44.dat	upx
behavioral19/memory/2728-50-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral19/files/0x0005000000004ed8-70.dat	upx
behavioral19/memory/2168-68-0x00000000001B0000-0x00000000001BD000-memory.dmp	upx
behavioral19/memory/1760-71-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral19/memory/1760-150-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral19/files/0x000600000001cdb7-183.dat	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	FreeMicrosoft.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnVi\splash.mp3	Antivirus.exe
File created	C:\Program Files (x86)\AnVi\virus.mp3	Antivirus.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File created	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File created	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File created	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File created	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File opened for modification	C:\windows\antivirus-platinum.exe	attrib.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259484200	AntivirusPlatinum.exe
File opened for modification	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral19/files/0x000400000001ce29-164.dat	nsis_installer_1
behavioral19/files/0x000400000001ce29-164.dat	nsis_installer_2

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1604	timeout.exe
2884	timeout.exe
1184	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2648	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	Antivirus.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	Antivirus.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\ = "ListView Columns Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\CLSID\ = "{1EFB6596-857C-11D1-B16A-00C0F0283628}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA40-E020-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl.2	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\ = "IButtons10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8556BCD2-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "c:\\windows\\comctl32.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.SBarCtrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\HELPDIR\ = "c:\\windows"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version\ = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\ = "IComboItems"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\ = "ITab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ = "IImages"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6597-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID\ = "{6B7E638F-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 22 IoCs

pid	Process
1916	FreeMicrosoft.exe
768	AntivirusPlatinum.exe
1656	Antivirus.exe
1392	runaway.exe
2472	runaway.exe
1520	runaway.exe
3032	runaway.exe
2992	runaway.exe
2284	Badgame.exe
1840	runaway.exe
2580	runaway.exe
3024	Hydra.exe
1140	runaway.exe
1976	runaway.exe
2132	runaway.exe
1824	runaway.exe
692	runaway.exe
1044	runaway.exe
1988	runaway.exe
888	runaway.exe
2252	runaway.exe
2216	SGen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1656	Antivirus.exe
1656	Antivirus.exe
1656	Antivirus.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1656	Antivirus.exe
1656	Antivirus.exe
1656	Antivirus.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
1760	antivirus-platinum.exe
1656	Antivirus.exe
1392	runaway.exe
1520	runaway.exe
2472	runaway.exe
1656	Antivirus.exe
1656	Antivirus.exe
1656	Antivirus.exe
3032	runaway.exe
1656	Antivirus.exe
2580	runaway.exe
1656	Antivirus.exe
2992	runaway.exe
1840	runaway.exe
1976	runaway.exe
1656	Antivirus.exe
1140	runaway.exe
2132	runaway.exe
1824	runaway.exe
692	runaway.exe
1044	runaway.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2476	2600	2repair.exe	30
PID 2600 wrote to memory of 2476	2600	2repair.exe	30
PID 2600 wrote to memory of 2476	2600	2repair.exe	30
PID 2600 wrote to memory of 2476	2600	2repair.exe	30
PID 2476 wrote to memory of 2884	2476	cmd.exe	31
PID 2476 wrote to memory of 2884	2476	cmd.exe	31
PID 2476 wrote to memory of 2884	2476	cmd.exe	31
PID 2476 wrote to memory of 1916	2476	cmd.exe	32
PID 2476 wrote to memory of 1916	2476	cmd.exe	32
PID 2476 wrote to memory of 1916	2476	cmd.exe	32
PID 2476 wrote to memory of 1916	2476	cmd.exe	32
PID 2476 wrote to memory of 324	2476	cmd.exe	34
PID 2476 wrote to memory of 324	2476	cmd.exe	34
PID 2476 wrote to memory of 324	2476	cmd.exe	34
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 768	2476	cmd.exe	35
PID 2476 wrote to memory of 1184	2476	cmd.exe	36
PID 2476 wrote to memory of 1184	2476	cmd.exe	36
PID 2476 wrote to memory of 1184	2476	cmd.exe	36
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 768 wrote to memory of 2728	768	AntivirusPlatinum.exe	37
PID 2728 wrote to memory of 2168	2728	302746537.exe	38
PID 2728 wrote to memory of 2168	2728	302746537.exe	38
PID 2728 wrote to memory of 2168	2728	302746537.exe	38
PID 2728 wrote to memory of 2168	2728	302746537.exe	38
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 784	2168	cmd.exe	40
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1240	2168	cmd.exe	41
PID 2168 wrote to memory of 1760	2168	cmd.exe	42
PID 2168 wrote to memory of 1760	2168	cmd.exe	42
PID 2168 wrote to memory of 1760	2168	cmd.exe	42
PID 2168 wrote to memory of 1760	2168	cmd.exe	42
PID 2168 wrote to memory of 1636	2168	cmd.exe	99
PID 2168 wrote to memory of 1636	2168	cmd.exe	99
PID 2168 wrote to memory of 1636	2168	cmd.exe	99
PID 2168 wrote to memory of 1636	2168	cmd.exe	99
PID 2476 wrote to memory of 1656	2476	cmd.exe	44
PID 2476 wrote to memory of 1656	2476	cmd.exe	44
PID 2476 wrote to memory of 1656	2476	cmd.exe	44
PID 2476 wrote to memory of 1656	2476	cmd.exe	44
PID 2476 wrote to memory of 1392	2476	cmd.exe	45
PID 2476 wrote to memory of 1392	2476	cmd.exe	45
PID 2476 wrote to memory of 1392	2476	cmd.exe	45

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	antivirus-platinum.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1636	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4F29.tmp\4F2A.tmp\4F2B.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
    FreeMicrosoft.exe
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    - Executes dropped EXE
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
    AntivirusPlatinum.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\WINDOWS\302746537.exe
      "C:\WINDOWS\302746537.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6AC4.tmp\302746537.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2168
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s c:\windows\comctl32.ocx
        6⤵
        Modifies registry class
        
        PID:784
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s c:\windows\mscomctl.ocx
        6⤵
        Modifies registry class
        
        PID:1240
      - \??\c:\windows\antivirus-platinum.exe
        
        c:\windows\antivirus-platinum.exe
        6⤵
        Windows security bypass
        Disables RegEdit via registry modification
        Executes dropped EXE
        Windows security modification
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1760
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h c:\windows\antivirus-platinum.exe
        6⤵
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:1636
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
    Antivirus.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      PID:2852
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        
        PID:1788
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt /y
      4⤵
      PID:348
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        5⤵
        
        PID:1672
  - - C:\Windows\SysWOW64\net.exe
      net start winmgmt
      4⤵
      PID:1564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start winmgmt
        5⤵
        
        PID:1864
  - - C:\Windows\SysWOW64\net.exe
      net start wscsvc
      4⤵
      PID:2952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start wscsvc
        5⤵
        
        PID:1992
  - - C:\Windows\SysWOW64\Wbem\mofcomp.exe
      mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
      4⤵
      PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1520
- - C:\Windows\system32\taskkill.exe
    taskkill /IM lsass.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
    Badgame.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
    Hydra.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:692
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    - Executes dropped EXE
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    - Executes dropped EXE
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
    SGen.exe
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2216
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC80F3.tmp.vbs"
      4⤵
      PID:832
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:1728
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
    PCOptimizerProInstaller.exe
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
    VirusCan.exe
    3⤵
    PID:2416
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\B589.tmp\VirusCan.bat""
      4⤵
      PID:2768
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2744
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1632
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:756
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1524
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:784
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1508
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1960
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2308
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
    matrix.exe
    3⤵
    PID:2420
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B5F7.tmp\B5F8.tmp\B5F9.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"
      4⤵
      PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
    bomb.exe
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
    ChilledWindows.exe
    3⤵
    PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16809222141490179511-226565117-933619308-1924021705542920775-2057225911196412738"
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F2B.bat

Path C:\Users\Admin\AppData\Local\Temp\4F29.tmp\4F2A.tmp\4F2B.bat
Size 853B
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746
MD5 SHA1 SHA512

Submit Download

302746537.bat

Path C:\Users\Admin\AppData\Local\Temp\6AC4.tmp\302746537.bat
Size 348B
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94
MD5 SHA1 SHA512

Submit Download

VirusCan.bat

Path C:\Users\Admin\AppData\Local\Temp\B589.tmp\VirusCan.bat
Size 82B
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2
MD5 SHA1 SHA512

Submit Download

B5F9.bat

Path C:\Users\Admin\AppData\Local\Temp\B5F7.tmp\B5F8.tmp\B5F9.bat
Size 193B
SHA256 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88
MD5 d03b3332e0eb70b0f9a987cabe089c17
SHA1 7d27ee89e5e7f02544728d9f5d227945eba76e56
SHA512 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0
MD5 SHA1 SHA512

Submit Download

Antivirus.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
Size 2.0MB
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724
SSDEEP 49152:FH/1Fdq0wneDrEoYxWFjmYMcKabLVp3diY7kp:FH/1Fdq0nIo2YAcl/NisA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AntivirusPlatinum.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
Size 739KB
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b
SSDEEP 12288:kUWA3AheuswygKEOKlC0DaWL8ldxj1UT1fzosC2kyINJATi1v2yUQpf84i:kUWqistgKErL8P6VzosCfE6TNpf8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Badgame.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
Size 61KB
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82
SSDEEP 768:kzyBMAbosR/s5ri95UcRLv0m9mPk9CyI45INeIJgCH1oJVtU+xQqUhsPJZjpBpwE:0yutxKXv9Ck9J5IgIJgooLf3heVbiX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChilledWindows.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
Size 4.4MB
SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
MD5 6a4853cd0584dc90067e15afb43c4962
SHA1 ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA512 feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996
SSDEEP 98304:XyDt6K4MJVnjOobt/JN1LA5elHc+S4fRp5UvluKo:XyDtK8bbxn+IHcBEV/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hydra.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
Size 43KB
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf
SSDEEP 768:1uy2FRMytCquuhuVWHzeYDroQXI2zeYDriexi:N6HeQXI1exi
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCOptimizerProInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
Size 3.6MB
SHA256 937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a
MD5 a50c74202e2f4d938babf556b9f54725
SHA1 6810db1606cac6ab19edbaa49620ba197ef7bc64
SHA512 28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9
SSDEEP 49152:ow3E/lpFJpOhj8ZJvL/QAwN1h1zjZblxwr2UGlm3qnzvSZsrKCB4TlwuwHNBb2j:paa4Zpc7h15bDwvGA6zvSZse7TSoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SGen.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
Size 16KB
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b
SSDEEP 192:qIvhz9kQU/hTyec0UmgGmKDWTckRKDVb1a4TtdLCp4aT7KDbiDbG/tY3dhxmm:u3c0dgGmKDQckRKDVbJapdKDGPGA7om
MD5 SHA1 SHA512 SSDEEP

Submit Download

VirusCan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
Size 25KB
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2
SSDEEP 768:eJHKmM0qauedFQFtxTXKXAx6ZQgZOgRTx7D:eQmMyTcTXfxhgZzT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bomb.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
Size 96KB
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18
SSDEEP 3072:MQbGvXEswPzMHmda1t7LajcqBTvqO2Czg1soUQYvq:M6GvXEYMNjcNTCkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

matrix.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
Size 121KB
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301
SSDEEP 1536:Q7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfdwPjyGBI2O:u7DhdC6kzWypvaQ0FxyNTBfd0jyGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

runaway.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
Size 8KB
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e
SSDEEP 96:iVVgYs1AwsKDUnjkmQWoDHLByKABzCcuTQDx+WpXOikN4PFmbIxzNt:iVrrjkmZoDHNyJl9uMDcWpXGN4PFRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

302746537.exe

Path C:\Windows\302746537.exe
Size 22KB
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
SSDEEP 384:fIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZht0MZaNJawcM:fRGuY2P0Vo6r7SiAwyrMRjbSMcnbcuy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

antivirus-platinum.exe

Path C:\Windows\antivirus-platinum.exe
Size 9KB
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6
SSDEEP 192:bypFwq/1Z6LKAVkPTDtlkZkH7KtkbT/zRAtO7/G97+vHiu9:bryfAVkvtSZkWaAtpxA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

comctl32.ocx

Path \??\c:\windows\comctl32.ocx
Size 595KB
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd
SSDEEP 12288:LUVJnkkCKDCUUgdxxnwH8aYvR4+NyEFVUmJ8ts:QvknYJ4xEFCmuu
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscomctl.ocx

Path \??\c:\windows\mscomctl.ocx
Size 1.0MB
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1
SSDEEP 24576:K2woQX9+gWX6b+SHQjxnRC33Oej3zR/QhF7OnVz3S7HM7BHg:5kX9+V6KTpcPhkgVSglg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Melting.exe

Path \Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Size 12KB
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11
SSDEEP 192:0TVtyoHzIj5dzyKa7gyh5QzpMm74ysT55tfoUK:utpTIj5dO52/HsTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

GetVersion.dll

Path \Users\Admin\AppData\Local\Temp\nstB53C.tmp\GetVersion.dll
Size 6KB
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321
SSDEEP 96:NIGlpc19q/Z+93GG+hnYJacN9F5XB5nUQHS+AlBi46AQ5Vu:CozB+9sncN9FFB5bHSTlBi46AQ5Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path \Users\Admin\AppData\Local\Temp\nstB53C.tmp\LangDLL.dll
Size 5KB
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac
SSDEEP 48:im14EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0Jgof5dwe:F16pl9NLBAZuYtR0Ld
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/692-126-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/692-133-0x00000000042B0000-0x00000000042F0000-memory.dmp

Download

memory/768-43-0x00000000005E0000-0x00000000005E6000-memory.dmp

Download

memory/768-153-0x0000000003080000-0x0000000003090000-memory.dmp

Download

memory/768-48-0x0000000003080000-0x0000000003090000-memory.dmp

Download

memory/888-142-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/888-146-0x0000000002060000-0x00000000020A0000-memory.dmp

Download

memory/952-143-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/952-136-0x00000000045C0000-0x0000000004600000-memory.dmp

Download

memory/1044-130-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1044-151-0x0000000004610000-0x0000000004650000-memory.dmp

Download

memory/1140-122-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1140-141-0x00000000047F0000-0x0000000004830000-memory.dmp

Download

memory/1392-83-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1392-85-0x0000000000490000-0x00000000004D0000-memory.dmp

Download

memory/1392-236-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1392-238-0x0000000000490000-0x00000000004D0000-memory.dmp

Download

memory/1520-231-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1520-82-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1520-86-0x0000000004980000-0x00000000049C0000-memory.dmp

Download

memory/1520-239-0x0000000004980000-0x00000000049C0000-memory.dmp

Download

memory/1716-197-0x00000000010F0000-0x0000000001554000-memory.dmp

Download

memory/1716-201-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Download

memory/1716-241-0x000000001B5D0000-0x000000001B650000-memory.dmp

Download

memory/1728-152-0x0000000004780000-0x00000000047C0000-memory.dmp

Download

memory/1728-144-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1760-71-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1760-150-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1824-129-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1824-135-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Download

memory/1840-244-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1840-113-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1840-140-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Download

memory/1976-138-0x00000000047C0000-0x0000000004800000-memory.dmp

Download

memory/1976-118-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/1988-145-0x0000000001F70000-0x0000000001FB0000-memory.dmp

Download

memory/1988-131-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2132-134-0x0000000004900000-0x0000000004940000-memory.dmp

Download

memory/2132-124-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2168-68-0x00000000001B0000-0x00000000001BD000-memory.dmp

Download

memory/2168-69-0x00000000001B0000-0x00000000001BD000-memory.dmp

Download

memory/2252-132-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2252-137-0x00000000045E0000-0x0000000004620000-memory.dmp

Download

memory/2284-166-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2400-204-0x000000006F6E0000-0x000000006F6E9000-memory.dmp

Download

memory/2400-206-0x000000006F6F0000-0x000000006F6F9000-memory.dmp

Download

memory/2416-175-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2416-207-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2456-203-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2456-230-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2472-240-0x00000000040F0000-0x0000000004130000-memory.dmp

Download

memory/2472-81-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Download

memory/2472-84-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2472-237-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2472-87-0x00000000040F0000-0x0000000004130000-memory.dmp

Download

memory/2580-246-0x0000000004940000-0x0000000004980000-memory.dmp

Download

memory/2580-119-0x0000000004940000-0x0000000004980000-memory.dmp

Download

memory/2580-139-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2728-50-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2992-243-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2992-97-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/2992-114-0x00000000049F0000-0x0000000004A30000-memory.dmp

Download

memory/3024-99-0x00000000013B0000-0x00000000013C0000-memory.dmp

Download

memory/3024-121-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/3024-205-0x0000000004E40000-0x0000000004E80000-memory.dmp

Download

memory/3032-94-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/3032-242-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/3032-116-0x0000000004680000-0x00000000046C0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads