6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
8s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Trojan/2repair.exe
Size 10.2MB
Sample240316-sq9desff34
SHA256 327e9f126a7d897239ddafc8adbae981e6a4c00d4d3383846ceb8d2befefef04
MD5 795d891f34890796120931c1b74318a4
SHA1 9a698435df1e850479f66b08dd8ee84e7473b0eb
SHA512 77234732395eac75687aeff81d40fc3e7b1f1d7e14b4df9f786f0aa7cc2bee04d5614dbd6cdd04fd310ea455c2747cd2c0a598143a886807e690c2cc01b06aa0
SSDEEP 196608:LgOzUNRd/74b/Mqe9NPnjRs6j+2ufWvi2DuFg3k7bwanYP9UX5hT84jWR/B:CRd83Klji52RhwPA92584jmB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral20/files/0x0006000000023339-186.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	AntivirusPlatinum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	302746537.exe

Executes dropped EXE 3 IoCs

pid	Process
4372	Melting.exe
2920	AntivirusPlatinum.exe
4184	302746537.exe

Loads dropped DLL 1 IoCs

pid	Process
2516	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral20/files/0x0006000000023331-43.dat	upx
behavioral20/memory/4184-53-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral20/files/0x000500000001e3d9-63.dat	upx
behavioral20/memory/2172-65-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral20/memory/4184-68-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral20/memory/2172-116-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral20/files/0x0006000000023339-186.dat	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	FreeMicrosoft.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240613578	AntivirusPlatinum.exe
File opened for modification	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File created	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File created	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File created	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File created	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\302746537.exe	AntivirusPlatinum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral20/files/0x0006000000023324-174.dat	nsis_installer_1
behavioral20/files/0x0006000000023324-174.dat	nsis_installer_2
behavioral20/files/0x0006000000023324-179.dat	nsis_installer_1
behavioral20/files/0x0006000000023324-179.dat	nsis_installer_2

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1864	timeout.exe
4340	timeout.exe
1164	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2260	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\ = "ListView General Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl.1\CLSID\ = "{6B7E638F-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ = "INodes"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\ = "Microsoft Slider Control, version 5.0 (SP2)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ = "IImageList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.TreeCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ = "ITreeViewEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer\ = "COMCTL.Toolbar.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ = "IPanel11"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ = "ITabStripEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32	regsvr32.exe

Runs net.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 764	796	2repair.exe	84
PID 796 wrote to memory of 764	796	2repair.exe	84
PID 764 wrote to memory of 1164	764	cmd.exe	85
PID 764 wrote to memory of 1164	764	cmd.exe	85
PID 764 wrote to memory of 4600	764	cmd.exe	86
PID 764 wrote to memory of 4600	764	cmd.exe	86
PID 764 wrote to memory of 4600	764	cmd.exe	86
PID 764 wrote to memory of 4372	764	cmd.exe	88
PID 764 wrote to memory of 4372	764	cmd.exe	88
PID 764 wrote to memory of 2920	764	cmd.exe	89
PID 764 wrote to memory of 2920	764	cmd.exe	89
PID 764 wrote to memory of 2920	764	cmd.exe	89
PID 764 wrote to memory of 1864	764	cmd.exe	90
PID 764 wrote to memory of 1864	764	cmd.exe	90
PID 2920 wrote to memory of 4184	2920	AntivirusPlatinum.exe	91
PID 2920 wrote to memory of 4184	2920	AntivirusPlatinum.exe	91
PID 2920 wrote to memory of 4184	2920	AntivirusPlatinum.exe	91
PID 4184 wrote to memory of 3240	4184	302746537.exe	92
PID 4184 wrote to memory of 3240	4184	302746537.exe	92
PID 4184 wrote to memory of 3240	4184	302746537.exe	92
PID 3240 wrote to memory of 2516	3240	cmd.exe	95
PID 3240 wrote to memory of 2516	3240	cmd.exe	95
PID 3240 wrote to memory of 2516	3240	cmd.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4900	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5F08.tmp\5F09.tmp\5F0A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
    FreeMicrosoft.exe
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    - Executes dropped EXE
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
    AntivirusPlatinum.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\WINDOWS\302746537.exe
      "C:\WINDOWS\302746537.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7A02.tmp\302746537.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3240
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s c:\windows\comctl32.ocx
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2516
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s c:\windows\mscomctl.ocx
        6⤵
        
        PID:4592
      - \??\c:\windows\antivirus-platinum.exe
        
        c:\windows\antivirus-platinum.exe
        6⤵
        
        PID:2172
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h c:\windows\antivirus-platinum.exe
        6⤵
        Views/modifies file attributes
        
        PID:4900
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
    Antivirus.exe
    3⤵
    PID:3728
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      PID:3228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        
        PID:2416
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt /y
      4⤵
      PID:2740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        5⤵
        
        PID:3260
  - - C:\Windows\SysWOW64\net.exe
      net start winmgmt
      4⤵
      PID:3740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start winmgmt
        5⤵
        
        PID:964
  - - C:\Windows\SysWOW64\net.exe
      net start wscsvc
      4⤵
      PID:5040
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start wscsvc
        5⤵
        
        PID:636
  - - C:\Windows\SysWOW64\Wbem\mofcomp.exe
      mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
      4⤵
      PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:2312
- - C:\Windows\system32\taskkill.exe
    taskkill /IM lsass.exe /F
    3⤵
    - Kills process with taskkill
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
    Badgame.exe
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
    Hydra.exe
    3⤵
    PID:1440
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
    SGen.exe
    3⤵
    PID:3096
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC8E55.tmp.vbs"
      4⤵
      PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
    runaway.exe
    3⤵
    PID:4980
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
    Melting.exe
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
    PCOptimizerProInstaller.exe
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
    VirusCan.exe
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BFB6.tmp\VirusCan.bat""
      4⤵
      PID:3632
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3472
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1636
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4952
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4900
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:404
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2596
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1984
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3548
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2840
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
    matrix.exe
    3⤵
    PID:5096
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C2A4.tmp\C2A5.tmp\C2A6.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"
      4⤵
      PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
    bomb.exe
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
    ChilledWindows.exe
    3⤵
    PID:5064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c 0x528
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 704KB
SHA256 07e314d54a3e51fc71a3443466e209f670702a2f876ae9ad9e66681071068d22
MD5 f8576876c21eb541a96206efce3dbdb2
SHA1 b72a576f555d100a9001c06081fa2822a16ed708
SHA512 bd9e0fb6c81b902d29ff8bf095424a9ee006a1499afb9f6bc7b1a1944bfc13386057779363a858d9a86c374cb512d774a10f20cd56dd9f857169eab3c63fb58d
SSDEEP 768:l0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaF:jZP2tFPuNnY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 0862650765fd972cacdbc4b00dd4fa2dbad560806fb514cb26f2e467a16892aa
MD5 e263038813d358a80df9e5b73171b1e5
SHA1 11c3792c8e8b1808f6adea8bda519f38182c8ba9
SHA512 bfc316158024f18b2d37e9235f142dc47903d78be85d2d7ea1b228b9356025ac42f79020bde2fb1cf9b71a15c6e26a65de3f4552e8fd239a251ba11e0c84569d
SSDEEP 768:l0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaf:jZP2tF
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

4otjesjty.mof

Path C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
Size 443B
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea
MD5 SHA1 SHA512

Submit Download

5F0A.bat

Path C:\Users\Admin\AppData\Local\Temp\5F08.tmp\5F09.tmp\5F0A.bat
Size 853B
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746
MD5 SHA1 SHA512

Submit Download

302746537.bat

Path C:\Users\Admin\AppData\Local\Temp\7A02.tmp\302746537.bat
Size 348B
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94
MD5 SHA1 SHA512

Submit Download

VirusCan.bat

Path C:\Users\Admin\AppData\Local\Temp\BFB6.tmp\VirusCan.bat
Size 82B
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2
MD5 SHA1 SHA512

Submit Download

C2A6.bat

Path C:\Users\Admin\AppData\Local\Temp\C2A4.tmp\C2A5.tmp\C2A6.bat
Size 193B
SHA256 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88
MD5 d03b3332e0eb70b0f9a987cabe089c17
SHA1 7d27ee89e5e7f02544728d9f5d227945eba76e56
SHA512 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0
MD5 SHA1 SHA512

Submit Download

SFC8E55.tmp.vbs

Path C:\Users\Admin\AppData\Local\Temp\SFC8E55.tmp.vbs
Size 748B
SHA256 77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056
MD5 c9f89015e169c812c60401d74883575f
SHA1 213bb6cde1d5930dcfa5e5584e42d52c4d160108
SHA512 c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e
MD5 SHA1 SHA512

Submit Download

Antivirus.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
Size 2.0MB
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724
SSDEEP 49152:FH/1Fdq0wneDrEoYxWFjmYMcKabLVp3diY7kp:FH/1Fdq0nIo2YAcl/NisA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AntivirusPlatinum.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
Size 739KB
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b
SSDEEP 12288:kUWA3AheuswygKEOKlC0DaWL8ldxj1UT1fzosC2kyINJATi1v2yUQpf84i:kUWqistgKErL8P6VzosCfE6TNpf8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Badgame.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
Size 61KB
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82
SSDEEP 768:kzyBMAbosR/s5ri95UcRLv0m9mPk9CyI45INeIJgCH1oJVtU+xQqUhsPJZjpBpwE:0yutxKXv9Ck9J5IgIJgooLf3heVbiX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChilledWindows.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
Size 531KB
SHA256 e98c203839af8c8ee4e96a8c9228085e49737c6f8f07092d98372b6517d0d2d5
MD5 cefdf132fd288aad5db2c52c3734ddc0
SHA1 c4daa49d8dfc37a5dd1e0a8b2773f8bae9eabbdb
SHA512 cc5d0d007237a7733d5a68e0068fcf68cce2ec323a1e3e755e93efbc2408c35216238f51d9b783eed2b90f4fa2c55a12776b5b32d03fb188420ef3035739ec5b
SSDEEP 12288:IIDRhPt6mWnhwj4qg/wHH4BneaF4KkibS20NWT3yQv:1jPt6mWhw0qg4HqFF43KSZCyQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChilledWindows.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
Size 502KB
SHA256 1f6d49e88a3bbb6ce41694e63846f4760c378754c8ab857fcd5e495f57403d08
MD5 25b21c4d7b071ae03c3567d39bd46d9c
SHA1 e321427597cda9e58d39db36a260257dfd805b39
SHA512 1808bd1e9626d318964920a32a2612626d1f953fa841f0ef5182d37823417edb2958737c300339bfd5c06cec1d9380d427d890b3017e0e244999217df3668248
SSDEEP 12288:IIDRhPt6mWnhwj4qg/wHH4BneaF4KkibS20NWT3yQ:1jPt6mWhw0qg4HqFF43KSZCyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hydra.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
Size 43KB
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf
SSDEEP 768:1uy2FRMytCquuhuVWHzeYDroQXI2zeYDriexi:N6HeQXI1exi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Melting.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Size 12KB
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11
SSDEEP 192:0TVtyoHzIj5dzyKa7gyh5QzpMm74ysT55tfoUK:utpTIj5dO52/HsTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCOptimizerProInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
Size 2.9MB
SHA256 b9abef1dcbb68fc3e75319498fded6171ac9304368e50168e03ca5c7a37c8102
MD5 78a6161dd54615fd9da789f2999fde64
SHA1 c535b5e2e2f87f75d6661d6a9c0c5253690890fc
SHA512 43f10a48be6eab25a4de1619415839bc3b6b107de5e38b3fa3a48e56e983a54b17d407faaf603a7ab419462e49b17a6cc069f5e8364315c55ed96714eca37a99
SSDEEP 49152:ow3E/lpFJpOhj8ZJvL/QAwN1h1zjZblxwr2UGlm3qnzvSZp:paa4Zpc7h15bDwvGA6zvSZp
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCOptimizerProInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
Size 2.2MB
SHA256 907ff65777ddeceea31f9b104671cc1099a0e2aa475ebe60a4faabab2970ab5c
MD5 234cee2aaa2596996789b78d34764131
SHA1 f5896578872b92080a241196779cdee460bbc94d
SHA512 42f95cdb9259947c668128a1c737706a8e4a4b29d0dbbed8a4d4dc1b1cfb44e0e8f0201a6f2d7d5f72f8b111db81416bcb1a9f7432bd28baa17a7e6a4dc26573
SSDEEP 24576:owRVmJg0tCsVTqOeRqpA7qJjNOwchs9Axt8AcwGPHHnLF1Q9PawJJRX8UthokFqQ:ow3E/lpFJpOhj8ZJvL/QAwN1h1zjZbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SGen.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
Size 16KB
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b
SSDEEP 192:qIvhz9kQU/hTyec0UmgGmKDWTckRKDVb1a4TtdLCp4aT7KDbiDbG/tY3dhxmm:u3c0dgGmKDQckRKDVbJapdKDGPGA7om
MD5 SHA1 SHA512 SSDEEP

Submit Download

SGen.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
Size 3KB
SHA256 0ddba6c089356f3ba66068036934e677ae577d845a814d2c685f6f0975923734
MD5 affb6af7946f9a3b1c22a0eb4f58549d
SHA1 d90a0f3797249f5e4d8fd92d6f4ce06a282c2e7f
SHA512 c517219d378fd2b597e886f2fa2003578264b4f058c2042183f06e6e6fe11b8b700755435bc9ff45cd55689e6c36a47da22eca3b1c43e0cea64d7010ace22f34
MD5 SHA1 SHA512

Submit Download

VirusCan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
Size 25KB
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2
SSDEEP 768:eJHKmM0qauedFQFtxTXKXAx6ZQgZOgRTx7D:eQmMyTcTXfxhgZzT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bomb.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
Size 96KB
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18
SSDEEP 3072:MQbGvXEswPzMHmda1t7LajcqBTvqO2Czg1soUQYvq:M6GvXEYMNjcNTCkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chilledwindows.mp4

Path C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4
Size 640KB
SHA256 8af8a785dcdd2b20719b5caf9ee19a219d45989db433fe7b834989b49d5add39
MD5 82475d648617d5b3d96d668126f79fe3
SHA1 45a8c6c816783f9efd7a33ac25f25910861df79b
SHA512 7487b0dfff147c0a662af4b34143b8c103dc2eb3ec3e37b1e5352c0d7683d19c747826f23ac7cead83491ed7f57803e31b8b9b6db677b449cf2cf127f9db444e
SSDEEP 12288:tL+7Do/2Ou7fEyEpWt/DnL7I/wc3hZ6g4QxKOR5GitFAkN7dRcq:B+dOu7DbfsYoX5RphQSzcq
MD5 SHA1 SHA512 SSDEEP

Submit Download

matrix.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
Size 121KB
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301
SSDEEP 1536:Q7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfdwPjyGBI2O:u7DhdC6kzWypvaQ0FxyNTBfd0jyGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

runaway.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
Size 1KB
SHA256 f84bc0b7676c729c1aca816837903ae4f68710aa23734f5d8c073d38247580a1
MD5 5a261f4bb7a137ef1eeaba3b4af198bb
SHA1 2a0a8c0a4978d709fde505c1536ba955e4e2aa9b
SHA512 c0809afe3122d9ea3011cce6b632b0278555cfe3d5e125663467d0e24f208d332eba85df53e0155c6dd9256f18a0c5abe6b1485d8fa95304912a17722939522e
MD5 SHA1 SHA512

Submit Download

runaway.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
Size 8KB
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e
SSDEEP 96:iVVgYs1AwsKDUnjkmQWoDHLByKABzCcuTQDx+WpXOikN4PFmbIxzNt:iVrrjkmZoDHNyJl9uMDcWpXGN4PFRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

GetVersion.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbBC9A.tmp\GetVersion.dll
Size 6KB
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321
SSDEEP 96:NIGlpc19q/Z+93GG+hnYJacN9F5XB5nUQHS+AlBi46AQ5Vu:CozB+9sncN9FFB5bHSTlBi46AQ5Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbBC9A.tmp\LangDLL.dll
Size 5KB
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac
SSDEEP 48:im14EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0Jgof5dwe:F16pl9NLBAZuYtR0Ld
MD5 SHA1 SHA512 SSDEEP

Submit Download

302746537.exe

Path C:\Windows\302746537.exe
Size 22KB
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
SSDEEP 384:fIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZht0MZaNJawcM:fRGuY2P0Vo6r7SiAwyrMRjbSMcnbcuy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

antivirus-platinum.exe

Path C:\Windows\antivirus-platinum.exe
Size 9KB
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6
SSDEEP 192:bypFwq/1Z6LKAVkPTDtlkZkH7KtkbT/zRAtO7/G97+vHiu9:bryfAVkvtSZkWaAtpxA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

comctl32.ocx

Path \??\c:\windows\comctl32.ocx
Size 595KB
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd
SSDEEP 12288:LUVJnkkCKDCUUgdxxnwH8aYvR4+NyEFVUmJ8ts:QvknYJ4xEFCmuu
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscomctl.ocx

Path \??\c:\windows\mscomctl.ocx
Size 1.0MB
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1
SSDEEP 24576:K2woQX9+gWX6b+SHQjxnRC33Oej3zR/QhF7OnVz3S7HM7BHg:5kX9+V6KTpcPhkgVSglg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-202-0x000000006FE80000-0x000000006FE89000-memory.dmp

Download

memory/1280-80-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/1280-120-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/1280-87-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/1348-153-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/1440-111-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/1440-103-0x0000000000930000-0x0000000000940000-memory.dmp

Download

memory/1440-110-0x00000000052B0000-0x00000000052BA000-memory.dmp

Download

memory/1440-107-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/1440-167-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/1440-165-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/1680-128-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2172-116-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2172-65-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2200-133-0x0000000004A40000-0x0000000004A50000-memory.dmp

Download

memory/2200-131-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2296-151-0x00000000047A0000-0x00000000047B0000-memory.dmp

Download

memory/2296-132-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2312-85-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/2312-83-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2312-124-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/2312-79-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2312-82-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Download

memory/2312-121-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2572-129-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2572-152-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/2572-93-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2572-95-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/2664-259-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2664-178-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2700-156-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/2700-99-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3032-150-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Download

memory/3032-145-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3176-146-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3176-149-0x00000000049F0000-0x0000000004A00000-memory.dmp

Download

memory/3248-109-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3248-166-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3248-113-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/3248-177-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/3268-138-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3576-206-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/3576-118-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3576-197-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3576-122-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/3744-96-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/3744-94-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3744-123-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3744-155-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/3764-168-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/3764-112-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/3764-115-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/3764-169-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/4184-68-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4184-53-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4568-105-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/4568-162-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/4568-106-0x0000000002F50000-0x0000000002F60000-memory.dmp

Download

memory/4904-164-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4980-154-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/5048-86-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/5048-84-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/5048-81-0x0000000005D10000-0x00000000062B4000-memory.dmp

Download

memory/5048-126-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/5048-117-0x0000000073AA0000-0x0000000074250000-memory.dmp

Download

memory/5064-201-0x0000000000160000-0x00000000005C4000-memory.dmp

Download

memory/5064-205-0x00007FF9AC500000-0x00007FF9ACFC1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads