Analysis Overview
SHA256
6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2
Threat Level: Known bad
The file Trojan.zip was found to be: Known bad.
Malicious Activity Summary
Windows security bypass
Drops file in Drivers directory
Possible privilege escalation attempt
Disables Task Manager via registry modification
Disables RegEdit via registry modification
Reads user/profile data of web browsers
Executes dropped EXE
Checks computer location settings
ACProtect 1.3x - 1.4x DLL software
Loads dropped DLL
UPX packed file
Modifies file permissions
Windows security modification
Enumerates connected drives
Modifies WinLogon
Adds Run key to start application
Modifies boot configuration data using bcdedit
Writes to the Master Boot Record (MBR)
Sets desktop wallpaper using registry
Drops file in Program Files directory
Drops file in Windows directory
Unsigned PE
Program crash
Enumerates physical storage devices
NSIS installer
Suspicious use of SendNotifyMessage
System policy modification
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Delays execution with timeout.exe
Suspicious use of AdjustPrivilegeToken
Runs net.exe
Suspicious use of FindShellTrayWindow
Kills process with taskkill
Modifies Internet Explorer start page
Modifies registry class
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Suspicious behavior: GetForegroundWindowSpam
Views/modifies file attributes
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: CmdExeWriteProcessMemorySpam
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-16 15:21
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral19
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:24
Platform
win7-20240221-en
Max time kernel
62s
Max time network
41s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe | N/A |
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\AnVi\splash.mp3 | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| File created | C:\Program Files (x86)\AnVi\virus.mp3 | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\MSCOMCTL.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\MSCOMCTL.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\302746537.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\302746537.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\windows\antivirus-platinum.exe | C:\Windows\SysWOW64\attrib.exe | N/A |
| File created | C:\Windows\__tmp_rar_sfx_access_check_259403017 | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\antivirus-platinum.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\COMCTL32.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\antivirus-platinum.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\COMCTL32.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
Enumerates physical storage devices
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main | \??\c:\windows\antivirus-platinum.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Modifies Internet Explorer start page
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" | \??\c:\windows\antivirus-platinum.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CurVer\ = "MSComctlLib.ImageComboCtl.2" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar.1\ = "Microsoft Toolbar Control, version 5.0 (SP2)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\ = "ListView Sort Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ = "IStatusBar" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider.2 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\ = "Slider Appearance Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1\CLSID\ = "{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ = "ITab10" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ = "IListItems" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\ = "Panel Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeaders11" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ = "IImageList" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "2.0" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Control | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ = "ITab" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\ProgID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID\ = "{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ = "IListItem11" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ = "ListViewEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Control | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\ = "Microsoft ProgressBar Control, version 5.0 (SP2)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Runs net.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1758.tmp\1759.tmp\175A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
FreeMicrosoft.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
AntivirusPlatinum.exe
C:\Windows\system32\timeout.exe
timeout /t 2
C:\WINDOWS\302746537.exe
"C:\WINDOWS\302746537.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\2D76.tmp\302746537.bat" "
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\comctl32.ocx
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\mscomctl.ocx
\??\c:\windows\antivirus-platinum.exe
c:\windows\antivirus-platinum.exe
C:\Windows\SysWOW64\attrib.exe
attrib +h c:\windows\antivirus-platinum.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
Antivirus.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\taskkill.exe
taskkill /IM lsass.exe /F
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
Badgame.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
Hydra.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
SGen.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\timeout.exe
timeout /t 10
C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC3820.tmp.vbs"
C:\Windows\SysWOW64\net.exe
net stop wscsvc
C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
C:\Windows\SysWOW64\net.exe
net start winmgmt
C:\Windows\SysWOW64\net.exe
net start wscsvc
C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start wscsvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
PCOptimizerProInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
VirusCan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
matrix.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
bomb.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
ChilledWindows.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6162.tmp\6163.tmp\6164.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\6171.tmp\VirusCan.bat""
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2320 -s 652
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | frequentwin.com | udp |
| US | 8.8.8.8:53 | fastsofgeld.com | udp |
| US | 8.8.8.8:53 | searchdusty.com | udp |
| CA | 54.39.157.64:80 | searchdusty.com | tcp |
| US | 8.8.8.8:53 | highway-traffic.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\1758.tmp\1759.tmp\175A.bat
| MD5 | 9eed2c0c3293d9424e3edacf3b36615d |
| SHA1 | 1d7743263a25661055549dd913ec5c654fa99ffd |
| SHA256 | 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2 |
| SHA512 | cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746 |
\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
| MD5 | 833619a4c9e8c808f092bf477af62618 |
| SHA1 | b4a0efa26f790e991cb17542c8e6aeb5030d1ebf |
| SHA256 | 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76 |
| SHA512 | 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11 |
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
| MD5 | 382430dd7eae8945921b7feab37ed36b |
| SHA1 | c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128 |
| SHA256 | 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b |
| SHA512 | 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b |
memory/2648-42-0x0000000000490000-0x0000000000496000-memory.dmp
C:\Windows\302746537.exe
| MD5 | 8703ff2e53c6fd3bc91294ef9204baca |
| SHA1 | 3dbb8f7f5dfe6b235486ab867a2844b1c2143733 |
| SHA256 | 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035 |
| SHA512 | d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204 |
memory/2592-49-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2D76.tmp\302746537.bat
| MD5 | 7d8beb22dfcfacbbc2609f88a41c1458 |
| SHA1 | 52ec2b10489736b963d39a9f84b66bafbf15685f |
| SHA256 | 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2 |
| SHA512 | a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94 |
\??\c:\windows\comctl32.ocx
| MD5 | 821511549e2aaf29889c7b812674d59b |
| SHA1 | 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6 |
| SHA256 | f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4 |
| SHA512 | 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd |
\??\c:\windows\mscomctl.ocx
| MD5 | 714cf24fc19a20ae0dc701b48ded2cf6 |
| SHA1 | d904d2fa7639c38ffb6e69f1ef779ca1001b8c18 |
| SHA256 | 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712 |
| SHA512 | d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1 |
C:\Windows\antivirus-platinum.exe
| MD5 | cd1800322ccfc425014a8394b01a4b3d |
| SHA1 | 171073975effde1c712dfd86309457fd457aed33 |
| SHA256 | 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0 |
| SHA512 | 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6 |
memory/2528-68-0x0000000000130000-0x000000000013D000-memory.dmp
memory/2528-70-0x0000000000130000-0x000000000013D000-memory.dmp
memory/2632-72-0x0000000000400000-0x000000000040D000-memory.dmp
memory/2592-73-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
| MD5 | c7e9746b1b039b8bd1106bca3038c38f |
| SHA1 | cb93ac887876bafe39c5f9aa64970d5e747fb191 |
| SHA256 | b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4 |
| SHA512 | cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724 |
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
| MD5 | 979b597855746aee2f30ee74f9d7c163 |
| SHA1 | 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f |
| SHA256 | dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11 |
| SHA512 | 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e |
memory/1308-80-0x0000000000050000-0x0000000000058000-memory.dmp
memory/884-81-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1308-82-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/3004-83-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/3004-84-0x0000000000340000-0x0000000000380000-memory.dmp
memory/884-85-0x0000000000210000-0x0000000000250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
| MD5 | ebfbd478a8cfc0fb645b8559973690cb |
| SHA1 | 88ec8dff51b53beed128582bcaf86ea81f684a0f |
| SHA256 | 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59 |
| SHA512 | 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82 |
memory/1612-117-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2120-118-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1612-119-0x0000000001E70000-0x0000000001EB0000-memory.dmp
memory/1636-120-0x0000000004890000-0x00000000048D0000-memory.dmp
memory/2248-121-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2272-122-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2264-123-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1392-124-0x00000000743F0000-0x0000000074ADE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
| MD5 | 3e20f1b0a3bb4c8608844e47d92d2121 |
| SHA1 | e2f84e46d4e63cbd091feeca686814752519596e |
| SHA256 | a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793 |
| SHA512 | 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b |
memory/2272-102-0x0000000000030000-0x0000000000040000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
| MD5 | b2eca909a91e1946457a0b36eaf90930 |
| SHA1 | 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa |
| SHA256 | 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c |
| SHA512 | 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf |
memory/1028-98-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2288-125-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2432-126-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2284-127-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1968-128-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/384-129-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2316-130-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1556-131-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1636-132-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/672-133-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2648-134-0x0000000000490000-0x0000000000496000-memory.dmp
memory/1968-135-0x00000000045C0000-0x0000000004600000-memory.dmp
memory/672-136-0x0000000004610000-0x0000000004650000-memory.dmp
memory/2272-137-0x00000000046E0000-0x0000000004720000-memory.dmp
memory/1028-139-0x0000000002080000-0x00000000020C0000-memory.dmp
memory/2632-142-0x0000000000400000-0x000000000040D000-memory.dmp
memory/1556-141-0x00000000005D0000-0x0000000000610000-memory.dmp
memory/884-143-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2248-144-0x0000000000480000-0x00000000004C0000-memory.dmp
memory/1308-140-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2120-145-0x0000000001ED0000-0x0000000001F10000-memory.dmp
memory/2316-138-0x0000000000450000-0x0000000000490000-memory.dmp
memory/2432-146-0x0000000004630000-0x0000000004670000-memory.dmp
memory/3004-147-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/3004-150-0x0000000000340000-0x0000000000380000-memory.dmp
memory/2272-151-0x00000000046E0000-0x0000000004720000-memory.dmp
memory/2248-154-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2120-156-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1612-155-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1636-153-0x0000000004890000-0x00000000048D0000-memory.dmp
memory/1028-152-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2272-158-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2264-159-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2288-161-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2432-162-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1392-160-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1968-164-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/384-165-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2316-166-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1636-167-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2284-163-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1612-157-0x0000000001E70000-0x0000000001EB0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
| MD5 | 7fad92afda308dca8acfc6ff45c80c24 |
| SHA1 | a7fa35e7f90f772fc943c2e940737a48b654c295 |
| SHA256 | 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f |
| SHA512 | 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea |
memory/672-176-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1556-172-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1676-185-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
| MD5 | a50c74202e2f4d938babf556b9f54725 |
| SHA1 | 6810db1606cac6ab19edbaa49620ba197ef7bc64 |
| SHA256 | 937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a |
| SHA512 | 28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9 |
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
| MD5 | 8edb51ed1d3241c4f026bb0d5de20f89 |
| SHA1 | 9453b850f98062c0b3955a58c295a662be605efb |
| SHA256 | c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47 |
| SHA512 | 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2 |
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
| MD5 | 05ad3f85b73e5ff86504f8dcc55b5d42 |
| SHA1 | 927d4554328cc6d767a566c3c6cb54c16d58857a |
| SHA256 | 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af |
| SHA512 | 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18 |
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
| MD5 | 83726a8767faba50ea1b5f31afef5938 |
| SHA1 | 70165dcc633f3390d98ae08c731113b007069737 |
| SHA256 | e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4 |
| SHA512 | e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301 |
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
| MD5 | 6a4853cd0584dc90067e15afb43c4962 |
| SHA1 | ae59bbb123e98dc8379d08887f83d7e52b1b47fc |
| SHA256 | ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec |
| SHA512 | feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996 |
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\GetVersion.dll
| MD5 | dc9562578490df8bc464071f125bfc19 |
| SHA1 | 56301a36ae4e3f92883f89f86b5d04da1e52770d |
| SHA256 | 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f |
| SHA512 | 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321 |
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\LangDLL.dll
| MD5 | de3558ce305e32f742ff25b697407fec |
| SHA1 | d55c50c546001421647f2e91780c324dbb8d6ebb |
| SHA256 | 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a |
| SHA512 | 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac |
memory/2516-234-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\6171.tmp\VirusCan.bat
| MD5 | 55dcde25c122c782757989a3c275fea2 |
| SHA1 | a669581a58e6aa602cbdaf690e3e365fa4de570f |
| SHA256 | 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916 |
| SHA512 | b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2 |
memory/1316-243-0x0000000000400000-0x000000000043E000-memory.dmp
Analysis: behavioral24
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
139s
Max time network
153s
Command Line
Signatures
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4216 wrote to memory of 5096 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 4216 wrote to memory of 5096 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 4216 wrote to memory of 5096 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 5096 wrote to memory of 1512 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 5096 wrote to memory of 1512 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 5096 wrote to memory of 1512 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\240618875.bat" "
C:\Windows\SysWOW64\cscript.exe
cscript [regtaskmgr.vbs]
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\240618875.bat
| MD5 | 826431d3df1879172a96555d7ba0aeef |
| SHA1 | f56ff5d3c06f78f53884071d1357ba79ee85b96e |
| SHA256 | e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee |
| SHA512 | e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52 |
memory/4216-2-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral28
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
158s
Command Line
Signatures
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5000 wrote to memory of 2204 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 5000 wrote to memory of 2204 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 5000 wrote to memory of 2204 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2204 wrote to memory of 3604 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2204 wrote to memory of 3604 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2204 wrote to memory of 3604 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\240616234.bat" "
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
Network
| Country | Destination | Domain | Proto |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.5.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\240616234.bat
| MD5 | 2e90ad588f5329388216c652eebd4a33 |
| SHA1 | baa4f47ee4f195d854f8db905fcbb2539556f0e0 |
| SHA256 | 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac |
| SHA512 | b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778 |
memory/5000-2-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral29
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:24
Platform
win7-20240221-en
Max time kernel
6s
Max time network
13s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
Files
memory/2172-0-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2984-1-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/2860-2-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
Analysis: behavioral30
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:25
Platform
win10v2004-20240226-en
Max time kernel
11s
Max time network
89s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "117" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b7055 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| GB | 216.58.212.202:443 | tcp | |
| US | 13.107.246.64:443 | tcp | |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.173.189.20.in-addr.arpa | udp |
Files
memory/2960-0-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral10
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
1s
Max time network
10s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:27
Platform
win10v2004-20240226-en
Max time kernel
185s
Max time network
198s
Command Line
Signatures
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.zip
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.5.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 174.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.178.17.96.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:24
Platform
win10v2004-20240226-en
Max time kernel
7s
Max time network
22s
Command Line
Signatures
Disables Task Manager via registry modification
Enumerates connected drives
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{231105DA-D766-4D29-8A8C-F62376996064} | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='UR NEXT'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'UR NEXT'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3941855 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.143.182.52.in-addr.arpa | udp |
Files
memory/3164-0-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/3164-1-0x0000000000D30000-0x00000000013DE000-memory.dmp
memory/3164-2-0x0000000006050000-0x0000000006060000-memory.dmp
memory/3164-3-0x0000000006610000-0x0000000006BB4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\windl.bat
| MD5 | a9401e260d9856d1134692759d636e92 |
| SHA1 | 4141d3c60173741e14f36dfe41588bb2716d2867 |
| SHA256 | b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7 |
| SHA512 | 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6 |
memory/3164-11-0x0000000006050000-0x0000000006060000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
| MD5 | 7050d5ae8acfbe560fa11073fef8185d |
| SHA1 | 5bc38e77ff06785fe0aec5a345c4ccd15752560e |
| SHA256 | cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b |
| SHA512 | a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b |
memory/3164-22-0x000000000BD30000-0x000000000BD68000-memory.dmp
memory/3164-23-0x000000000BCF0000-0x000000000BCFE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rniw.exe
| MD5 | 9232120b6ff11d48a90069b25aa30abc |
| SHA1 | 97bb45f4076083fca037eee15d001fd284e53e47 |
| SHA256 | 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be |
| SHA512 | b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877 |
memory/3164-29-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-30-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-32-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-34-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-35-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-36-0x000000000CE10000-0x000000000CE20000-memory.dmp
memory/3164-37-0x000000000CE10000-0x000000000CE20000-memory.dmp
memory/3164-39-0x000000000CE10000-0x000000000CE20000-memory.dmp
memory/3164-41-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-38-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-43-0x000000000CE10000-0x000000000CE20000-memory.dmp
memory/3164-42-0x000000000BD80000-0x000000000BD90000-memory.dmp
memory/3164-44-0x000000000CE10000-0x000000000CE20000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | 8794caa036af6a75f6391b04ef129655 |
| SHA1 | 735c3286d37bccc06f3b59bcec628500d97289cc |
| SHA256 | 85067bb06385694e1ac7eae5d17cdd3a090524746c47018569f7a165b5f73ff1 |
| SHA512 | 13aa0cfffd092a8ccc317707d55f77f07f4d7f403b4dbfe1418794e5481cf217f18aaaae313d99760876e1912fcd3ceb94961506c198ad8cbf358d827438fca1 |
C:\Users\Admin\AppData\Local\Temp\text.txt
| MD5 | 9037ebf0a18a1c17537832bc73739109 |
| SHA1 | 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60 |
| SHA256 | 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48 |
| SHA512 | 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f |
C:\Users\Admin\AppData\Local\Temp\one.rtf
| MD5 | 6fbd6ce25307749d6e0a66ebbc0264e7 |
| SHA1 | faee71e2eac4c03b96aabecde91336a6510fff60 |
| SHA256 | e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690 |
| SHA512 | 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064 |
memory/3164-863-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/3164-864-0x0000000074B80000-0x0000000075330000-memory.dmp
Analysis: behavioral17
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240221-en
Max time kernel
1s
Max time network
4s
Command Line
Signatures
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1032 wrote to memory of 2500 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
| PID 1032 wrote to memory of 2500 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
| PID 1032 wrote to memory of 2500 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
| PID 1032 wrote to memory of 2500 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
Network
Files
memory/1032-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp
memory/1032-0-0x00000000000A0000-0x00000000000B8000-memory.dmp
memory/1032-2-0x0000000004D90000-0x0000000004DD0000-memory.dmp
Analysis: behavioral22
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
163s
Max time network
174s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2172 wrote to memory of 4360 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2172 wrote to memory of 4360 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4801.tmp\4811.tmp\4812.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 138.201.86.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 142.250.180.10:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 10.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\4801.tmp\4811.tmp\4812.bat
| MD5 | ffa0ad441b308bc1da589f8a734e806f |
| SHA1 | 704fc5c8773489b91d2f1ef221ab60ecd3257e3e |
| SHA256 | c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1 |
| SHA512 | bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b |
Analysis: behavioral14
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:25
Platform
win10v2004-20240226-en
Max time kernel
68s
Max time network
100s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4488 wrote to memory of 1872 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 4488 wrote to memory of 1872 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 4488 wrote to memory of 1872 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 4488 wrote to memory of 1528 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe |
| PID 4488 wrote to memory of 1528 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe |
| PID 4488 wrote to memory of 1528 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"
C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im lsass.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 187.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
memory/4488-0-0x0000000000490000-0x00000000004B6000-memory.dmp
memory/4488-1-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/4488-2-0x00000000053C0000-0x0000000005964000-memory.dmp
memory/4488-3-0x0000000004EF0000-0x0000000004F82000-memory.dmp
memory/4488-4-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/4488-5-0x0000000004EC0000-0x0000000004ECA000-memory.dmp
memory/1528-6-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4488-7-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/4488-8-0x00000000050D0000-0x00000000050E0000-memory.dmp
Analysis: behavioral26
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:23
Platform
win10v2004-20240226-en
Max time kernel
4s
Max time network
12s
Command Line
Signatures
Disables Task Manager via registry modification
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='No System Anymore'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'No System Anymore'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 81.171.91.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
Files
memory/540-0-0x00000000743C0000-0x0000000074B70000-memory.dmp
memory/540-1-0x0000000000AD0000-0x000000000119A000-memory.dmp
memory/540-2-0x0000000006160000-0x0000000006704000-memory.dmp
memory/540-3-0x0000000005BB0000-0x0000000005C42000-memory.dmp
memory/540-4-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/540-5-0x0000000005D40000-0x0000000005D4A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\z666.bat
| MD5 | ee655674ba8e05d5a4c32de58a6757c1 |
| SHA1 | f06f54710d5a0b341a9e6d467e1bb1a78f2f9606 |
| SHA256 | 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef |
| SHA512 | 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd |
C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe
| MD5 | ef4e8ea4440efc48d5cd1a05a3a6f2a8 |
| SHA1 | 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068 |
| SHA256 | b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709 |
| SHA512 | f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4 |
C:\Users\Admin\AppData\Local\Temp\bsod.exe
| MD5 | f1896231e9622dd044601962a9866a77 |
| SHA1 | 36ad39e7d797ae43ee415e90a2dc234e0be3087b |
| SHA256 | a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8 |
| SHA512 | e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901 |
C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt
| MD5 | 391403276c6df4a164b0544a3411c6c7 |
| SHA1 | c4c06a4c7710d1d8140b07abd4b7bcd4187485ab |
| SHA256 | 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b |
| SHA512 | 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8 |
memory/540-821-0x00000000743C0000-0x0000000074B70000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
139s
Max time network
156s
Command Line
Signatures
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Disables Task Manager via registry modification
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
System policy modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"
Network
| Country | Destination | Domain | Proto |
| GB | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 2.17.5.133:80 | www.microsoft.com | tcp |
| GB | 2.17.5.133:80 | www.microsoft.com | tcp |
| US | 8.8.8.8:53 | 133.5.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.117.168.52.in-addr.arpa | udp |
Files
Analysis: behavioral27
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240220-en
Max time kernel
141s
Max time network
129s
Command Line
Signatures
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3064 wrote to memory of 2744 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3064 wrote to memory of 2744 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3064 wrote to memory of 2744 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3064 wrote to memory of 2744 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2744 wrote to memory of 2516 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2744 wrote to memory of 2516 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2744 wrote to memory of 2516 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2744 wrote to memory of 2516 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\259398368.bat" "
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM explorer.exe
Network
Files
C:\Users\Admin\AppData\Local\Temp\259398368.bat
| MD5 | 2e90ad588f5329388216c652eebd4a33 |
| SHA1 | baa4f47ee4f195d854f8db905fcbb2539556f0e0 |
| SHA256 | 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac |
| SHA512 | b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778 |
memory/2744-12-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/3064-17-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral15
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240221-en
Max time kernel
0s
Max time network
7s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
Network
Files
Analysis: behavioral8
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
117s
Max time network
154s
Command Line
Signatures
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\drivers\rteth.sys | C:\Windows\system32\cmd.exe | N/A |
Possible privilege escalation attempt
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Windows\Temp\winconfig.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Temp\winconfig.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\DetectKey.exe | N/A |
Modifies file permissions
Modifies boot configuration data using bcdedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
C:\Windows\Temp\winconfig.exe
"C:\Windows\Temp\winconfig.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A728.tmp\A739.tmp\A73A.bat C:\Windows\Temp\winconfig.exe"
C:\Users\Admin\AppData\Roaming\DetectKey.exe
"C:\Users\Admin\AppData\Roaming\DetectKey.exe"
C:\Windows\system32\bcdedit.exe
bcdedit /delete {current}
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='mmc.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='PartAssist.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='control.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='CCleaner.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64a.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='regedit.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='iexplore.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='chrome.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='firefox.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='opera.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='edge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='msedge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='brave.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='wmplayer.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad++.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskmgr.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\hal.dll"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\winload.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\ntoskrnl.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\perfmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\resmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskkill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tasklist.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tskill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Program Files\Process Hacker 2"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\drivers"
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\System32\drivers" /grant "everyone":F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.64.52.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
Files
C:\Windows\Temp\winconfig.exe
| MD5 | 11d457ee914f72a436fa4a8a8f8446dd |
| SHA1 | d0308ca82ed9716b667e8e77e9ae013b9af44116 |
| SHA256 | c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef |
| SHA512 | 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b |
C:\Users\Admin\AppData\Local\Temp\A728.tmp\A739.tmp\A73A.bat
| MD5 | a645734f3bf4a2682cbaf546789ec0c4 |
| SHA1 | fafcc11909412bf51f217e12dfaa93a15181a3e2 |
| SHA256 | 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0 |
| SHA512 | efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d |
C:\Users\Admin\AppData\Roaming\DetectKey.exe
| MD5 | aba9a3cf4e1db4602c25405987b809a6 |
| SHA1 | 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80 |
| SHA256 | 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6 |
| SHA512 | e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675 |
C:\Users\Admin\AppData\Roaming\DetectKey.exe
| MD5 | cb2d77ba014f0a9d55dd30799287a316 |
| SHA1 | f4c1f4846e8367d04a3a8c151ebc78ec2ecff71c |
| SHA256 | d62af5baf48e4227736e586b039eac6b8cab2a118fced8d2738e271f343ce6d8 |
| SHA512 | e4ee6685057104bf7e41290842b310550325fc635d99cd0c1fd15a56dfcc85bafe845d5e923b1279c061f45bf40ecb770447d7c414729e40b5ec91f46c283eef |
Analysis: behavioral16
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
7s
Max time network
46s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3924 -ip 3924
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 492
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | 202.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:24
Platform
win7-20240221-en
Max time kernel
53s
Max time network
64s
Command Line
Signatures
Disables Task Manager via registry modification
Enumerates connected drives
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='UR NEXT'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'UR NEXT'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
Files
memory/2568-0-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/2568-1-0x00000000003E0000-0x0000000000A8E000-memory.dmp
memory/2568-2-0x0000000005260000-0x00000000052A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\windl.bat
| MD5 | a9401e260d9856d1134692759d636e92 |
| SHA1 | 4141d3c60173741e14f36dfe41588bb2716d2867 |
| SHA256 | b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7 |
| SHA512 | 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6 |
memory/2568-15-0x0000000005260000-0x00000000052A0000-memory.dmp
memory/2568-16-0x0000000000C20000-0x0000000000C2A000-memory.dmp
memory/2568-17-0x0000000000C20000-0x0000000000C2A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rniw.exe
| MD5 | 9232120b6ff11d48a90069b25aa30abc |
| SHA1 | 97bb45f4076083fca037eee15d001fd284e53e47 |
| SHA256 | 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be |
| SHA512 | b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877 |
C:\Users\Admin\AppData\Local\Temp\v.mp4
| MD5 | d2774b188ab5dde3e2df5033a676a0b4 |
| SHA1 | 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc |
| SHA256 | 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443 |
| SHA512 | 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131 |
memory/2568-26-0x000000006BF70000-0x000000006C282000-memory.dmp
memory/2568-27-0x0000000005140000-0x000000000514A000-memory.dmp
memory/2568-28-0x0000000005140000-0x000000000514A000-memory.dmp
memory/2568-29-0x0000000005140000-0x000000000514A000-memory.dmp
memory/2568-30-0x0000000005240000-0x000000000524A000-memory.dmp
memory/2568-31-0x0000000005240000-0x000000000524A000-memory.dmp
memory/2568-33-0x0000000005250000-0x000000000525A000-memory.dmp
memory/2568-32-0x0000000005240000-0x000000000524A000-memory.dmp
memory/2568-34-0x0000000004880000-0x0000000004881000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\text.txt
| MD5 | 9037ebf0a18a1c17537832bc73739109 |
| SHA1 | 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60 |
| SHA256 | 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48 |
| SHA512 | 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f |
C:\Users\Admin\AppData\Local\Temp\one.rtf
| MD5 | 6fbd6ce25307749d6e0a66ebbc0264e7 |
| SHA1 | faee71e2eac4c03b96aabecde91336a6510fff60 |
| SHA256 | e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690 |
| SHA512 | 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064 |
memory/2568-554-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/1864-841-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/2568-845-0x000000006BF70000-0x000000006C282000-memory.dmp
memory/2568-844-0x0000000005240000-0x000000000524A000-memory.dmp
memory/2568-846-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/2568-843-0x0000000005260000-0x00000000052A0000-memory.dmp
memory/2568-842-0x0000000005250000-0x0000000005255000-memory.dmp
memory/2980-847-0x0000000002760000-0x0000000002761000-memory.dmp
Analysis: behavioral13
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:25
Platform
win7-20240221-en
Max time kernel
63s
Max time network
18s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"
C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im lsass.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
Files
memory/2724-1-0x00000000747F0000-0x0000000074EDE000-memory.dmp
memory/2724-0-0x0000000000270000-0x0000000000296000-memory.dmp
memory/2724-2-0x0000000004D20000-0x0000000004D60000-memory.dmp
memory/2772-3-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2724-4-0x00000000747F0000-0x0000000074EDE000-memory.dmp
memory/2724-5-0x0000000004D20000-0x0000000004D60000-memory.dmp
Analysis: behavioral32
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:27
Platform
win10v2004-20240226-en
Max time kernel
107s
Max time network
172s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 840 wrote to memory of 4516 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
| PID 840 wrote to memory of 4516 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FE9.tmp\FEA.tmp\FEB.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 185.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.178.17.96.in-addr.arpa | udp |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 201.64.52.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\FE9.tmp\FEA.tmp\FEB.bat
| MD5 | f2d5cf0bf3d6ec8c6d5dc97af835c5e5 |
| SHA1 | 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6 |
| SHA256 | 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c |
| SHA512 | 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:27
Platform
win7-20240221-en
Max time kernel
122s
Max time network
150s
Command Line
Signatures
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Disables Task Manager via registry modification
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
System policy modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"
Network
Files
Analysis: behavioral21
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240221-en
Max time kernel
118s
Max time network
147s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2504 wrote to memory of 2532 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2504 wrote to memory of 2532 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2504 wrote to memory of 2532 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2504 wrote to memory of 2532 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BC4D.tmp\BC4E.tmp\BC4F.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp\BC4E.tmp\BC4F.bat
| MD5 | ffa0ad441b308bc1da589f8a734e806f |
| SHA1 | 704fc5c8773489b91d2f1ef221ab60ecd3257e3e |
| SHA256 | c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1 |
| SHA512 | bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b |
Analysis: behavioral31
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20231129-en
Max time kernel
120s
Max time network
127s
Command Line
Signatures
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1364 wrote to memory of 2620 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
| PID 1364 wrote to memory of 2620 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
| PID 1364 wrote to memory of 2620 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\27EB.tmp\27EC.tmp\27ED.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\27EB.tmp\27EC.tmp\27ED.bat
| MD5 | f2d5cf0bf3d6ec8c6d5dc97af835c5e5 |
| SHA1 | 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6 |
| SHA256 | 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c |
| SHA512 | 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240221-en
Max time kernel
121s
Max time network
134s
Command Line
Signatures
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.zip
Network
Files
Analysis: behavioral9
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240221-en
Max time kernel
0s
Max time network
7s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"
Network
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:27
Platform
win7-20240221-en
Max time kernel
121s
Max time network
149s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
Files
memory/2792-0-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral12
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:27
Platform
win10v2004-20240226-en
Max time kernel
162s
Max time network
213s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 216.58.213.10:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 10.213.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.173.189.20.in-addr.arpa | udp |
Files
memory/2416-0-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral18
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win10v2004-20240226-en
Max time kernel
0s
Max time network
25s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"
Network
Files
Analysis: behavioral20
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:24
Platform
win10v2004-20231215-en
Max time kernel
8s
Max time network
77s
Command Line
Signatures
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation | C:\WINDOWS\302746537.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| N/A | N/A | C:\WINDOWS\302746537.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe | N/A |
Drops file in Windows directory
Enumerates physical storage devices
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\ = "ListView General Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl.1\CLSID\ = "{6B7E638F-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ = "INodes" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Programmable | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\ = "Microsoft Slider Control, version 5.0 (SP2)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus\ = "0" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ = "IImageList" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.TreeCtrl.1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ = "ITreeViewEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer\ = "COMCTL.Toolbar.1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\CLSID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ = "IPanel11" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Version | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ = "ITabStripEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Programmable | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Runs net.exe
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5F08.tmp\5F09.tmp\5F0A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
FreeMicrosoft.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
AntivirusPlatinum.exe
C:\Windows\system32\timeout.exe
timeout /t 2
C:\WINDOWS\302746537.exe
"C:\WINDOWS\302746537.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7A02.tmp\302746537.bat" "
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\comctl32.ocx
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\mscomctl.ocx
\??\c:\windows\antivirus-platinum.exe
c:\windows\antivirus-platinum.exe
C:\Windows\SysWOW64\attrib.exe
attrib +h c:\windows\antivirus-platinum.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
Antivirus.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\taskkill.exe
taskkill /IM lsass.exe /F
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
Badgame.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
Hydra.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
SGen.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC8E55.tmp.vbs"
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\timeout.exe
timeout /t 10
C:\Windows\SysWOW64\net.exe
net stop wscsvc
C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
C:\Windows\SysWOW64\net.exe
net start winmgmt
C:\Windows\SysWOW64\net.exe
net start wscsvc
C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start wscsvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
PCOptimizerProInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
VirusCan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
matrix.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
bomb.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
ChilledWindows.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BFB6.tmp\VirusCan.bat""
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C2A4.tmp\C2A5.tmp\C2A6.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c 0x528
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\5F08.tmp\5F09.tmp\5F0A.bat
| MD5 | 9eed2c0c3293d9424e3edacf3b36615d |
| SHA1 | 1d7743263a25661055549dd913ec5c654fa99ffd |
| SHA256 | 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2 |
| SHA512 | cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746 |
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
| MD5 | 833619a4c9e8c808f092bf477af62618 |
| SHA1 | b4a0efa26f790e991cb17542c8e6aeb5030d1ebf |
| SHA256 | 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76 |
| SHA512 | 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11 |
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
| MD5 | 382430dd7eae8945921b7feab37ed36b |
| SHA1 | c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128 |
| SHA256 | 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b |
| SHA512 | 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b |
C:\Windows\302746537.exe
| MD5 | 8703ff2e53c6fd3bc91294ef9204baca |
| SHA1 | 3dbb8f7f5dfe6b235486ab867a2844b1c2143733 |
| SHA256 | 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035 |
| SHA512 | d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204 |
memory/4184-53-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7A02.tmp\302746537.bat
| MD5 | 7d8beb22dfcfacbbc2609f88a41c1458 |
| SHA1 | 52ec2b10489736b963d39a9f84b66bafbf15685f |
| SHA256 | 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2 |
| SHA512 | a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94 |
\??\c:\windows\comctl32.ocx
| MD5 | 821511549e2aaf29889c7b812674d59b |
| SHA1 | 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6 |
| SHA256 | f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4 |
| SHA512 | 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd |
\??\c:\windows\mscomctl.ocx
| MD5 | 714cf24fc19a20ae0dc701b48ded2cf6 |
| SHA1 | d904d2fa7639c38ffb6e69f1ef779ca1001b8c18 |
| SHA256 | 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712 |
| SHA512 | d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1 |
C:\Windows\antivirus-platinum.exe
| MD5 | cd1800322ccfc425014a8394b01a4b3d |
| SHA1 | 171073975effde1c712dfd86309457fd457aed33 |
| SHA256 | 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0 |
| SHA512 | 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6 |
memory/2172-65-0x0000000000400000-0x000000000040D000-memory.dmp
memory/4184-68-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
| MD5 | c7e9746b1b039b8bd1106bca3038c38f |
| SHA1 | cb93ac887876bafe39c5f9aa64970d5e747fb191 |
| SHA256 | b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4 |
| SHA512 | cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724 |
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
| MD5 | 979b597855746aee2f30ee74f9d7c163 |
| SHA1 | 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f |
| SHA256 | dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11 |
| SHA512 | 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e |
memory/1280-80-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/5048-81-0x0000000005D10000-0x00000000062B4000-memory.dmp
memory/2312-82-0x0000000004D20000-0x0000000004DB2000-memory.dmp
memory/2312-79-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2312-83-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/5048-84-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2312-85-0x0000000004D10000-0x0000000004D20000-memory.dmp
memory/5048-86-0x0000000005910000-0x0000000005920000-memory.dmp
memory/1280-87-0x00000000051D0000-0x00000000051E0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
| MD5 | ebfbd478a8cfc0fb645b8559973690cb |
| SHA1 | 88ec8dff51b53beed128582bcaf86ea81f684a0f |
| SHA256 | 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59 |
| SHA512 | 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82 |
memory/2572-93-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3744-94-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2572-95-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/3744-96-0x0000000005320000-0x0000000005330000-memory.dmp
memory/2700-99-0x0000000073AA0000-0x0000000074250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
| MD5 | b2eca909a91e1946457a0b36eaf90930 |
| SHA1 | 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa |
| SHA256 | 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c |
| SHA512 | 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf |
memory/1440-103-0x0000000000930000-0x0000000000940000-memory.dmp
memory/4568-105-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/4568-106-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/1440-107-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3248-109-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/1440-111-0x0000000005160000-0x0000000005170000-memory.dmp
memory/1440-110-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/3764-112-0x00000000056E0000-0x00000000056F0000-memory.dmp
memory/3248-113-0x0000000004C30000-0x0000000004C40000-memory.dmp
memory/3764-115-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2172-116-0x0000000000400000-0x000000000040D000-memory.dmp
memory/5048-117-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3576-118-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/1280-120-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2312-121-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3576-122-0x0000000005680000-0x0000000005690000-memory.dmp
memory/3744-123-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2312-124-0x0000000004D10000-0x0000000004D20000-memory.dmp
memory/5048-126-0x0000000005910000-0x0000000005920000-memory.dmp
memory/1680-128-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2572-129-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2200-131-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2296-132-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/2200-133-0x0000000004A40000-0x0000000004A50000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
| MD5 | affb6af7946f9a3b1c22a0eb4f58549d |
| SHA1 | d90a0f3797249f5e4d8fd92d6f4ce06a282c2e7f |
| SHA256 | 0ddba6c089356f3ba66068036934e677ae577d845a814d2c685f6f0975923734 |
| SHA512 | c517219d378fd2b597e886f2fa2003578264b4f058c2042183f06e6e6fe11b8b700755435bc9ff45cd55689e6c36a47da22eca3b1c43e0cea64d7010ace22f34 |
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
| MD5 | 3e20f1b0a3bb4c8608844e47d92d2121 |
| SHA1 | e2f84e46d4e63cbd091feeca686814752519596e |
| SHA256 | a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793 |
| SHA512 | 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b |
memory/3268-138-0x0000000073AA0000-0x0000000074250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
| MD5 | 5a261f4bb7a137ef1eeaba3b4af198bb |
| SHA1 | 2a0a8c0a4978d709fde505c1536ba955e4e2aa9b |
| SHA256 | f84bc0b7676c729c1aca816837903ae4f68710aa23734f5d8c073d38247580a1 |
| SHA512 | c0809afe3122d9ea3011cce6b632b0278555cfe3d5e125663467d0e24f208d332eba85df53e0155c6dd9256f18a0c5abe6b1485d8fa95304912a17722939522e |
memory/3032-145-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3176-146-0x0000000073AA0000-0x0000000074250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\SFC8E55.tmp.vbs
| MD5 | c9f89015e169c812c60401d74883575f |
| SHA1 | 213bb6cde1d5930dcfa5e5584e42d52c4d160108 |
| SHA256 | 77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056 |
| SHA512 | c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e |
memory/3176-149-0x00000000049F0000-0x0000000004A00000-memory.dmp
memory/3032-150-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/2572-152-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/2296-151-0x00000000047A0000-0x00000000047B0000-memory.dmp
memory/1348-153-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/4980-154-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3744-155-0x0000000005320000-0x0000000005330000-memory.dmp
memory/2700-156-0x0000000073AA0000-0x0000000074250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
| MD5 | 7fad92afda308dca8acfc6ff45c80c24 |
| SHA1 | a7fa35e7f90f772fc943c2e940737a48b654c295 |
| SHA256 | 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f |
| SHA512 | 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea |
memory/4568-162-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/4904-164-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1440-165-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3248-166-0x0000000073AA0000-0x0000000074250000-memory.dmp
memory/3764-168-0x00000000056E0000-0x00000000056F0000-memory.dmp
memory/1440-167-0x0000000005160000-0x0000000005170000-memory.dmp
memory/3764-169-0x0000000073AA0000-0x0000000074250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
| MD5 | 78a6161dd54615fd9da789f2999fde64 |
| SHA1 | c535b5e2e2f87f75d6661d6a9c0c5253690890fc |
| SHA256 | b9abef1dcbb68fc3e75319498fded6171ac9304368e50168e03ca5c7a37c8102 |
| SHA512 | 43f10a48be6eab25a4de1619415839bc3b6b107de5e38b3fa3a48e56e983a54b17d407faaf603a7ab419462e49b17a6cc069f5e8364315c55ed96714eca37a99 |
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
| MD5 | 8edb51ed1d3241c4f026bb0d5de20f89 |
| SHA1 | 9453b850f98062c0b3955a58c295a662be605efb |
| SHA256 | c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47 |
| SHA512 | 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2 |
memory/3248-177-0x0000000004C30000-0x0000000004C40000-memory.dmp
memory/2664-178-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
| MD5 | 234cee2aaa2596996789b78d34764131 |
| SHA1 | f5896578872b92080a241196779cdee460bbc94d |
| SHA256 | 907ff65777ddeceea31f9b104671cc1099a0e2aa475ebe60a4faabab2970ab5c |
| SHA512 | 42f95cdb9259947c668128a1c737706a8e4a4b29d0dbbed8a4d4dc1b1cfb44e0e8f0201a6f2d7d5f72f8b111db81416bcb1a9f7432bd28baa17a7e6a4dc26573 |
C:\Users\Admin\AppData\Local\Temp\nsbBC9A.tmp\LangDLL.dll
| MD5 | de3558ce305e32f742ff25b697407fec |
| SHA1 | d55c50c546001421647f2e91780c324dbb8d6ebb |
| SHA256 | 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a |
| SHA512 | 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac |
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
| MD5 | 83726a8767faba50ea1b5f31afef5938 |
| SHA1 | 70165dcc633f3390d98ae08c731113b007069737 |
| SHA256 | e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4 |
| SHA512 | e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301 |
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
| MD5 | 05ad3f85b73e5ff86504f8dcc55b5d42 |
| SHA1 | 927d4554328cc6d767a566c3c6cb54c16d58857a |
| SHA256 | 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af |
| SHA512 | 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18 |
C:\Users\Admin\AppData\Local\Temp\nsbBC9A.tmp\GetVersion.dll
| MD5 | dc9562578490df8bc464071f125bfc19 |
| SHA1 | 56301a36ae4e3f92883f89f86b5d04da1e52770d |
| SHA256 | 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f |
| SHA512 | 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321 |
memory/3576-197-0x0000000073AA0000-0x0000000074250000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
| MD5 | cefdf132fd288aad5db2c52c3734ddc0 |
| SHA1 | c4daa49d8dfc37a5dd1e0a8b2773f8bae9eabbdb |
| SHA256 | e98c203839af8c8ee4e96a8c9228085e49737c6f8f07092d98372b6517d0d2d5 |
| SHA512 | cc5d0d007237a7733d5a68e0068fcf68cce2ec323a1e3e755e93efbc2408c35216238f51d9b783eed2b90f4fa2c55a12776b5b32d03fb188420ef3035739ec5b |
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
| MD5 | 25b21c4d7b071ae03c3567d39bd46d9c |
| SHA1 | e321427597cda9e58d39db36a260257dfd805b39 |
| SHA256 | 1f6d49e88a3bbb6ce41694e63846f4760c378754c8ab857fcd5e495f57403d08 |
| SHA512 | 1808bd1e9626d318964920a32a2612626d1f953fa841f0ef5182d37823417edb2958737c300339bfd5c06cec1d9380d427d890b3017e0e244999217df3668248 |
memory/5064-201-0x0000000000160000-0x00000000005C4000-memory.dmp
memory/548-202-0x000000006FE80000-0x000000006FE89000-memory.dmp
memory/5064-205-0x00007FF9AC500000-0x00007FF9ACFC1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp\VirusCan.bat
| MD5 | 55dcde25c122c782757989a3c275fea2 |
| SHA1 | a669581a58e6aa602cbdaf690e3e365fa4de570f |
| SHA256 | 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916 |
| SHA512 | b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2 |
memory/3576-206-0x0000000005680000-0x0000000005690000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
| MD5 | 7050d5ae8acfbe560fa11073fef8185d |
| SHA1 | 5bc38e77ff06785fe0aec5a345c4ccd15752560e |
| SHA256 | cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b |
| SHA512 | a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b |
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp\C2A5.tmp\C2A6.bat
| MD5 | d03b3332e0eb70b0f9a987cabe089c17 |
| SHA1 | 7d27ee89e5e7f02544728d9f5d227945eba76e56 |
| SHA256 | 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88 |
| SHA512 | 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0 |
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | f8576876c21eb541a96206efce3dbdb2 |
| SHA1 | b72a576f555d100a9001c06081fa2822a16ed708 |
| SHA256 | 07e314d54a3e51fc71a3443466e209f670702a2f876ae9ad9e66681071068d22 |
| SHA512 | bd9e0fb6c81b902d29ff8bf095424a9ee006a1499afb9f6bc7b1a1944bfc13386057779363a858d9a86c374cb512d774a10f20cd56dd9f857169eab3c63fb58d |
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | e263038813d358a80df9e5b73171b1e5 |
| SHA1 | 11c3792c8e8b1808f6adea8bda519f38182c8ba9 |
| SHA256 | 0862650765fd972cacdbc4b00dd4fa2dbad560806fb514cb26f2e467a16892aa |
| SHA512 | bfc316158024f18b2d37e9235f142dc47903d78be85d2d7ea1b228b9356025ac42f79020bde2fb1cf9b71a15c6e26a65de3f4552e8fd239a251ba11e0c84569d |
memory/2664-259-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4
| MD5 | 82475d648617d5b3d96d668126f79fe3 |
| SHA1 | 45a8c6c816783f9efd7a33ac25f25910861df79b |
| SHA256 | 8af8a785dcdd2b20719b5caf9ee19a219d45989db433fe7b834989b49d5add39 |
| SHA512 | 7487b0dfff147c0a662af4b34143b8c103dc2eb3ec3e37b1e5352c0d7683d19c747826f23ac7cead83491ed7f57803e31b8b9b6db677b449cf2cf127f9db444e |
Analysis: behavioral23
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:27
Platform
win7-20240221-en
Max time kernel
125s
Max time network
27s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2128 wrote to memory of 2460 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2128 wrote to memory of 2460 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2128 wrote to memory of 2460 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2128 wrote to memory of 2460 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2460 wrote to memory of 2476 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 2460 wrote to memory of 2476 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 2460 wrote to memory of 2476 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 2460 wrote to memory of 2476 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\259441456.bat" "
C:\Windows\SysWOW64\cscript.exe
cscript [regtaskmgr.vbs]
Network
Files
C:\Users\Admin\AppData\Local\Temp\259441456.bat
| MD5 | 826431d3df1879172a96555d7ba0aeef |
| SHA1 | f56ff5d3c06f78f53884071d1357ba79ee85b96e |
| SHA256 | e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee |
| SHA512 | e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52 |
memory/2460-12-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/2128-17-0x0000000000400000-0x0000000000407000-memory.dmp
memory/2460-31-0x00000000022F0000-0x00000000022F1000-memory.dmp
Analysis: behavioral25
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:24
Platform
win7-20240221-en
Max time kernel
4s
Max time network
9s
Command Line
Signatures
Disables Task Manager via registry modification
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='No System Anymore'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'No System Anymore'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
Files
memory/2164-0-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/2164-1-0x0000000000E70000-0x000000000153A000-memory.dmp
memory/2164-2-0x00000000053B0000-0x00000000053F0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\z666.bat
| MD5 | ee655674ba8e05d5a4c32de58a6757c1 |
| SHA1 | f06f54710d5a0b341a9e6d467e1bb1a78f2f9606 |
| SHA256 | 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef |
| SHA512 | 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd |
C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe
| MD5 | ef4e8ea4440efc48d5cd1a05a3a6f2a8 |
| SHA1 | 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068 |
| SHA256 | b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709 |
| SHA512 | f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4 |
C:\Users\Admin\AppData\Local\Temp\bsod.exe
| MD5 | f1896231e9622dd044601962a9866a77 |
| SHA1 | 36ad39e7d797ae43ee415e90a2dc234e0be3087b |
| SHA256 | a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8 |
| SHA512 | e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901 |
C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt
| MD5 | 391403276c6df4a164b0544a3411c6c7 |
| SHA1 | c4c06a4c7710d1d8140b07abd4b7bcd4187485ab |
| SHA256 | 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b |
| SHA512 | 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8 |
memory/384-823-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/2164-824-0x00000000744C0000-0x0000000074BAE000-memory.dmp
memory/2016-825-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
Analysis: behavioral7
Detonation Overview
Submitted
2024-03-16 15:20
Reported
2024-03-16 15:26
Platform
win7-20240215-en
Max time kernel
97s
Max time network
17s
Command Line
Signatures
Possible privilege escalation attempt
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Temp\winconfig.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\DetectKey.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Modifies file permissions
Modifies boot configuration data using bcdedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\DetectKey.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"
C:\Windows\Temp\winconfig.exe
"C:\Windows\Temp\winconfig.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3543.tmp\3554.tmp\3555.bat C:\Windows\Temp\winconfig.exe"
C:\Users\Admin\AppData\Roaming\DetectKey.exe
"C:\Users\Admin\AppData\Roaming\DetectKey.exe"
C:\Windows\system32\bcdedit.exe
bcdedit /delete {current}
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='mmc.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='PartAssist.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='control.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='CCleaner.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64a.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='regedit.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='iexplore.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='chrome.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='firefox.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='opera.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='edge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='msedge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='brave.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='wmplayer.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad++.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskmgr.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\hal.dll"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\winload.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\ntoskrnl.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\perfmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\resmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskkill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tasklist.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tskill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Program Files\Process Hacker 2"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\drivers"
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\System32\drivers" /grant "everyone":F
C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T
Network
Files
\Windows\Temp\winconfig.exe
| MD5 | 11d457ee914f72a436fa4a8a8f8446dd |
| SHA1 | d0308ca82ed9716b667e8e77e9ae013b9af44116 |
| SHA256 | c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef |
| SHA512 | 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b |
C:\Users\Admin\AppData\Local\Temp\3543.tmp\3554.tmp\3555.bat
| MD5 | a645734f3bf4a2682cbaf546789ec0c4 |
| SHA1 | fafcc11909412bf51f217e12dfaa93a15181a3e2 |
| SHA256 | 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0 |
| SHA512 | efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d |
C:\Users\Admin\AppData\Roaming\DetectKey.exe
| MD5 | aba9a3cf4e1db4602c25405987b809a6 |
| SHA1 | 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80 |
| SHA256 | 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6 |
| SHA512 | e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675 |