Malware Analysis Report

2025-01-22 18:57

Sample ID 240316-thpvgsgc43
Target Zachy.exe
SHA256 3a7cbe964538873967a52d5808758aeb17b6ecde8deaffee227e036c0e709689
Tags
gozi banker isfb spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a7cbe964538873967a52d5808758aeb17b6ecde8deaffee227e036c0e709689

Threat Level: Known bad

The file Zachy.exe was found to be: Known bad.

Malicious Activity Summary

gozi banker isfb spyware stealer trojan

Gozi

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of UnmapMainImage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 16:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 16:03

Reported

2024-03-16 16:06

Platform

win7-20240221-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Zachy.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Users\Admin\AppData\Local\Temp\Zachy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2164 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 2284 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 2284 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 2284 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2284 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2284 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2284 wrote to memory of 2624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2284 wrote to memory of 2624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2284 wrote to memory of 2624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Zachy.exe

"C:\Users\Admin\AppData\Local\Temp\Zachy.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c start C:\Windows\GameBarPresenceWriter\uefidriver.exe >nul

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Zachy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\certutil.exe

certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Zachy.exe" MD5

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

Network

Country Destination Domain Proto
N/A 127.0.0.1:49190 tcp
N/A 127.0.0.1:49192 tcp
US 8.8.8.8:53 keyauth.win udp
US 104.26.0.5:443 keyauth.win tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 173.222.13.40:80 x2.c.lencr.org tcp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 16:03

Reported

2024-03-16 16:06

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.amazonaws.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Users\Admin\AppData\Local\Temp\Zachy.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings\shell\open\command C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings\shell\open\command C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings\shell C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings\shell\open C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\jumpswim47619861.vbs" C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1628 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 1628 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 468 N/A C:\Windows\system32\cmd.exe C:\Windows\GameBarPresenceWriter\uefidriver.exe
PID 2080 wrote to memory of 468 N/A C:\Windows\system32\cmd.exe C:\Windows\GameBarPresenceWriter\uefidriver.exe
PID 2080 wrote to memory of 468 N/A C:\Windows\system32\cmd.exe C:\Windows\GameBarPresenceWriter\uefidriver.exe
PID 1628 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 1628 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\Zachy.exe C:\Windows\system32\cmd.exe
PID 3104 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 3104 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 3104 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3104 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3104 wrote to memory of 4208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3104 wrote to memory of 4208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 468 wrote to memory of 5060 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\reg.exe
PID 468 wrote to memory of 5060 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\reg.exe
PID 468 wrote to memory of 5060 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\reg.exe
PID 468 wrote to memory of 3852 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\reg.exe
PID 468 wrote to memory of 3852 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\reg.exe
PID 468 wrote to memory of 3852 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\reg.exe
PID 468 wrote to memory of 4752 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\cmd.exe
PID 468 wrote to memory of 4752 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\cmd.exe
PID 468 wrote to memory of 4752 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\cmd.exe
PID 4752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ComputerDefaults.exe
PID 4752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ComputerDefaults.exe
PID 4752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ComputerDefaults.exe
PID 1980 wrote to memory of 2684 N/A C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\SysWOW64\wscript.exe
PID 1980 wrote to memory of 2684 N/A C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\SysWOW64\wscript.exe
PID 1980 wrote to memory of 2684 N/A C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\SysWOW64\wscript.exe
PID 2684 wrote to memory of 3628 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 3628 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 3628 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 468 wrote to memory of 2080 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\cmd.exe
PID 468 wrote to memory of 2080 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\cmd.exe
PID 468 wrote to memory of 2080 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2080 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2080 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 468 wrote to memory of 4916 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe
PID 468 wrote to memory of 4916 N/A C:\Windows\GameBarPresenceWriter\uefidriver.exe C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE
PID 4916 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Zachy.exe

"C:\Users\Admin\AppData\Local\Temp\Zachy.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c start C:\Windows\GameBarPresenceWriter\uefidriver.exe >nul

C:\Windows\GameBarPresenceWriter\uefidriver.exe

C:\Windows\GameBarPresenceWriter\uefidriver.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Zachy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\certutil.exe

certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Zachy.exe" MD5

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jumpswim47619861.vbs" /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C computerdefaults.exe

C:\Windows\SysWOW64\ComputerDefaults.exe

computerdefaults.exe

C:\Windows\SysWOW64\wscript.exe

"wscript.exe" C:\Users\Admin\AppData\Local\Temp\jumpswim47619861.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN ZoomAutoUpdater_ZRhrJN2oxBRsd61vu050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\ZRhrJN2oxBRsd61vu050MX.exe" /RL HIGHEST /IT

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /SC ONLOGON /TN ZoomAutoUpdater_ZRhrJN2oxBRsd61vu050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\ZRhrJN2oxBRsd61vu050MX.exe" /RL HIGHEST /IT

C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe

"C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe" explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 keyauth.win udp
US 104.26.0.5:443 keyauth.win tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 173.222.13.40:80 x2.c.lencr.org tcp
US 8.8.8.8:53 5.0.26.104.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 40.13.222.173.in-addr.arpa udp
N/A 127.0.0.1:61393 tcp
N/A 127.0.0.1:61396 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 textpubshiers.top udp
US 104.21.79.145:443 textpubshiers.top tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 145.79.21.104.in-addr.arpa udp
US 8.8.8.8:53 keyauth.win udp
US 104.26.0.5:443 keyauth.win tcp
N/A 127.0.0.1:61428 tcp
N/A 127.0.0.1:61430 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 checkip.amazonaws.com udp
IE 54.195.244.4:80 checkip.amazonaws.com tcp
US 104.21.79.145:443 textpubshiers.top tcp
US 8.8.8.8:53 4.244.195.54.in-addr.arpa udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

C:\Windows\GameBarPresenceWriter\uefidriver.exe

MD5 fab7d20b6a4ea57bb75c04223bc967a4
SHA1 0274ada30fe0929c5048a21e562f52d5b31adcfc
SHA256 053006923f1503fbf9f6163423e7a4c7ac05108bed2c2ade0329ff2b09b5e00f
SHA512 4fdfe4f34fd3d5a728a0bde44cd758811bbba8ae0f67d0cf2a38197fb725786a02b360de0c43af31775e7c4fe1b3d8093aa1feb1a65223c631c31e3fd6b0d497

memory/468-4-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

memory/468-6-0x0000000002610000-0x000000000262A000-memory.dmp

memory/468-5-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/468-8-0x0000000004E00000-0x0000000004E10000-memory.dmp

memory/468-9-0x0000000004D10000-0x0000000004DA2000-memory.dmp

memory/468-7-0x00000000025E0000-0x00000000025EA000-memory.dmp

memory/468-10-0x00000000053C0000-0x0000000005964000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jumpswim47619861.vbs

MD5 a34267102c21aff46aecc85598924544
SHA1 77268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256 eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA512 5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

memory/468-14-0x000000000AB00000-0x000000000B700000-memory.dmp

memory/468-16-0x00000000118A0000-0x0000000012542000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

MD5 6f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1 fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA256 70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512 fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

memory/468-22-0x00000000749C0000-0x0000000075170000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xldfnd1p.exe

MD5 e898826598a138f86f2aa80c0830707a
SHA1 1e912a5671f7786cc077f83146a0484e5a78729c
SHA256 df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA512 6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

memory/3452-32-0x0000000003050000-0x0000000003058000-memory.dmp

memory/3452-33-0x0000000003090000-0x0000000003091000-memory.dmp

memory/3452-34-0x0000000003050000-0x0000000003058000-memory.dmp

memory/3452-36-0x0000000003050000-0x0000000003058000-memory.dmp

memory/3452-37-0x0000000003050000-0x0000000003058000-memory.dmp

memory/468-43-0x0000000007750000-0x0000000007762000-memory.dmp

memory/468-44-0x0000000006260000-0x00000000062C6000-memory.dmp

memory/468-45-0x00000000047C0000-0x00000000047CA000-memory.dmp

memory/468-47-0x0000000009120000-0x000000000912A000-memory.dmp

memory/468-46-0x0000000004E00000-0x0000000004E10000-memory.dmp

memory/468-48-0x0000000009130000-0x000000000913C000-memory.dmp

memory/468-49-0x000000000A680000-0x000000000A688000-memory.dmp

C:\Users\Admin\AppData\Roaming\Gongle\aP0YKRODAR\qapp529h.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

MD5 73e0092d8b9c8b46593d7add9c9c9576
SHA1 0d004b37e938d2a3d8171b6acf450f8c7d0d3eec
SHA256 4b9ee3b3036a98bf5fcf87e4e3f6fe49806db9edc879a3a841898cdf334b261f
SHA512 79b5a62951dd465d9a8dab6c4c857aa29f153ab0eccae97733c8bf5165b185773a73d051dd282abc1516cc9c25a8fcdb39150f572cb888dff7bd178e7e6ef83b

C:\Users\Admin\AppData\Roaming\Gongle\aAN10VZOWF\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Gongle\aAN10VZOWF\LOG

MD5 b98f1116a69c4652317f8750e3ff3fc2
SHA1 64b1b88c1a9869c43951674868545ef87d31475a
SHA256 f6284923f117b693e9a81911ede7e9e806de4b643685bc05c67a7a188a7f409e
SHA512 d2df1183c76332a6ec41408007087a7a8f62802b2fb2a3fdffefc4cd117c1dc0473322bb473fa5d51770a275fc3b8b7e92bcfb90644bf12c747cd643328639a5

C:\Users\Admin\AppData\Roaming\Gongle\aAN10VZOWF\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Gongle\aAN10VZOWF\LOG.old

MD5 d78e152172aad0eb3b4862d368ce4f38
SHA1 f21bf0e9ee095dd627d0d3a8fb2ece2fc997850e
SHA256 252d2baa0fa41bda339e075ddcb781c1713f69e76b3f9881a828c2710d3042a3
SHA512 baddc188b872ef5a112bb0a7af02f9fcb7062b5043e09a502808f35c946f714736c77b37a0e1013b3214cfbaf23a19b8e1399cd79ddbdaa972b05562272c55a3

C:\Users\Admin\AppData\Roaming\Gongle\aV2228191R\LOG.old

MD5 cadd54ca78d3497d3c5a9bb9547bc61f
SHA1 593c14a3ff78f0cfd83e4bea59c4514254f2ae64
SHA256 11bef36176b4f2c0ee84c9dbee31d93247e01452ba57d43225591cfd2b6b0c52
SHA512 2f2b72cdfc774ae02687dcbf4c6262acdcf6edbdff22d4f5d9eeca1be8e9cc6d6ee332371a0fe32e8ce1d869b1cbce897bfef5ad859a73b4e75f1db3483871f6

memory/468-176-0x0000000000AE0000-0x0000000000B92000-memory.dmp

memory/468-177-0x0000000006580000-0x00000000065A2000-memory.dmp

memory/468-178-0x0000000006630000-0x00000000066A6000-memory.dmp

memory/468-179-0x00000000065D0000-0x00000000065EE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Gongle\aV2228191R\LOG

MD5 4309231ba3a189904653bdb9972c68f8
SHA1 9fbc0f35aebfbf81f1aabd57b4f530d575aa62c8
SHA256 2e3fefb7091da12d60c4acaf88dfa451957d2095b3f83a7ef43638504431b7c6
SHA512 f388cf3585ae5a9b787fa4ca4ebbd53d3dca522baf2804a671460c8d2edeaed1d72a6fb157f5403d28c67d24b7d28cc2a1f16ce3113b8f085263b57406859053

memory/468-181-0x000000000A7D0000-0x000000000A820000-memory.dmp

memory/468-182-0x0000000008D60000-0x0000000008DCA000-memory.dmp

memory/468-183-0x000000000D300000-0x000000000D654000-memory.dmp

memory/468-184-0x000000000D660000-0x000000000D6AC000-memory.dmp

memory/468-188-0x000000000D710000-0x000000000D74C000-memory.dmp

memory/468-189-0x000000000D6D0000-0x000000000D6F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3ed4e7ea9f154f30ba9a5353958a8962

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\07ab2f6a4c4a4cb4b21dad9a9d4bd500

MD5 6d46d3c74425c03b9fdf1c4a3cac78af
SHA1 fecb8c75b35f7182785b1e6ca4ef1f6f356d8fc4
SHA256 362123f9e94a408b6534407d9b29bcc57884d9ecf672b44e2cf3c4776706b5e4
SHA512 7d43f0d388da4bcd981f51763005982d229aaee45387e401d9e2bcf36081ea4e685301ae2b29630ede54b8e38d2420a269769b49f25755761d1bf9d654511c70

memory/468-203-0x000000000D7A0000-0x000000000D7AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e98a4be15db24c9fa575c88ed55ce851

MD5 6374e218c1345d1a2ab055aa7848d213
SHA1 f60e260d2a48a64a17b51ca8d08f33561ad2f55e
SHA256 a444ad33e0e0409810bbf346e7ffc44402d7683af916789e7ed0e6974b56a965
SHA512 8109228b996ce8b743b859813b2b76bc5ce23667c033ab2b8cf321b25b7c97a3eb5513c776f9d2f7bf79502e059837bd70c95fea6c68d5289919549789086b18

memory/468-208-0x0000000004E00000-0x0000000004E10000-memory.dmp