Analysis Overview
SHA256
6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2
Threat Level: Known bad
The file Trojan.zip was found to be: Known bad.
Malicious Activity Summary
Windows security bypass
Disables RegEdit via registry modification
Drops file in Drivers directory
Possible privilege escalation attempt
Disables Task Manager via registry modification
Reads user/profile data of web browsers
Loads dropped DLL
UPX packed file
Checks computer location settings
ACProtect 1.3x - 1.4x DLL software
Modifies file permissions
Windows security modification
Executes dropped EXE
Writes to the Master Boot Record (MBR)
Adds Run key to start application
Modifies boot configuration data using bcdedit
Enumerates connected drives
Modifies WinLogon
Sets desktop wallpaper using registry
Drops file in Windows directory
Drops file in Program Files directory
Unsigned PE
Enumerates physical storage devices
Program crash
NSIS installer
Suspicious use of FindShellTrayWindow
Views/modifies file attributes
Modifies data under HKEY_USERS
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Kills process with taskkill
Modifies registry class
Modifies Internet Explorer settings
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Delays execution with timeout.exe
Modifies Internet Explorer start page
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-16 17:15
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral8
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20231215-en
Max time kernel
97s
Max time network
95s
Command Line
Signatures
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\drivers\rteth.sys | C:\Windows\system32\cmd.exe | N/A |
Possible privilege escalation attempt
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation | C:\Windows\Temp\winconfig.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Temp\winconfig.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\DetectKey.exe | N/A |
Modifies file permissions
Modifies boot configuration data using bcdedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"
C:\Windows\Temp\winconfig.exe
"C:\Windows\Temp\winconfig.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7DAC.tmp\7DAD.tmp\7DBD.bat C:\Windows\Temp\winconfig.exe"
C:\Users\Admin\AppData\Roaming\DetectKey.exe
"C:\Users\Admin\AppData\Roaming\DetectKey.exe"
C:\Windows\system32\bcdedit.exe
bcdedit /delete {current}
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='mmc.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='PartAssist.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='control.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='CCleaner.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64a.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='regedit.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='iexplore.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='chrome.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='firefox.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='opera.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='edge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='msedge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='brave.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='wmplayer.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad++.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskmgr.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\hal.dll"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\winload.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\ntoskrnl.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\perfmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\resmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskkill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tasklist.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tskill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Program Files\Process Hacker 2"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\drivers"
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\System32\drivers" /grant "everyone":F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
Files
C:\Windows\Temp\winconfig.exe
| MD5 | 80ac1035b644c94121fd7829a3375be7 |
| SHA1 | 136393d6b3c20462fcb26768976c0e42a87979f3 |
| SHA256 | 95334115b13eae96a4462164f4830a46494c1c7620542cc81344f61a213e3119 |
| SHA512 | 53e2f8cb33aa45d8a4ef7c3488607bb2b7fe5518657d2a7394523b5e5cddcc07def5b2e8f12a1b9d694ca3d7f19d3aac86650ffa4f647a454392c46cffe9cd09 |
C:\Windows\Temp\winconfig.exe
| MD5 | cec18978927f727867d8433dd1184184 |
| SHA1 | 20b96c5e1afc6f4da110e89e958c941784aad99a |
| SHA256 | 564fbf3f9be4cbc1805805198817978d85417c062d30b758c1155c360b6e0d20 |
| SHA512 | 1cfc33686e36c81a314aad85a8841123a1a8dcff50a510b6379bd995ccdcf91adf3d8a8d6ae160be3470ce3a21f73929faf0bb1ddd1674525fd916f81def08c0 |
C:\Windows\Temp\winconfig.exe
| MD5 | c3b9c81da556ca70c5d0135f12063dbd |
| SHA1 | 309bebe859fd2ecf016f14bd4d68bdffeec0bf8d |
| SHA256 | bec2b6917d140c8f8640f08cb1906c495c50482d3f1386082cc5e97c3a4df2f8 |
| SHA512 | 3528884c2be9609a7333f62837deda67b45f70b167361f9bf258a9d9b159d517864846c85d196cd19e4f0d291a4a53d8b0338675176503b07e004bfb96f04b3e |
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp\7DAD.tmp\7DBD.bat
| MD5 | a645734f3bf4a2682cbaf546789ec0c4 |
| SHA1 | fafcc11909412bf51f217e12dfaa93a15181a3e2 |
| SHA256 | 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0 |
| SHA512 | efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d |
C:\Users\Admin\AppData\Roaming\DetectKey.exe
| MD5 | aba9a3cf4e1db4602c25405987b809a6 |
| SHA1 | 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80 |
| SHA256 | 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6 |
| SHA512 | e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675 |
Analysis: behavioral12
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:34
Platform
win10v2004-20240226-en
Max time kernel
147s
Max time network
207s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.143.182.52.in-addr.arpa | udp |
Files
memory/1016-0-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
122s
Max time network
139s
Command Line
Signatures
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Disables Task Manager via registry modification
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
System policy modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"
Network
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:30
Platform
win7-20240221-en
Max time kernel
5s
Max time network
9s
Command Line
Signatures
Disables Task Manager via registry modification
Enumerates connected drives
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='UR NEXT'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'UR NEXT'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
Files
memory/2920-0-0x0000000074A50000-0x000000007513E000-memory.dmp
memory/2920-1-0x0000000001380000-0x0000000001A2E000-memory.dmp
memory/2920-2-0x00000000050E0000-0x0000000005120000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\windl.bat
| MD5 | a9401e260d9856d1134692759d636e92 |
| SHA1 | 4141d3c60173741e14f36dfe41588bb2716d2867 |
| SHA256 | b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7 |
| SHA512 | 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6 |
memory/2920-16-0x0000000000620000-0x000000000062A000-memory.dmp
memory/2920-15-0x0000000000620000-0x000000000062A000-memory.dmp
memory/2920-17-0x00000000050E0000-0x0000000005120000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rniw.exe
| MD5 | 9232120b6ff11d48a90069b25aa30abc |
| SHA1 | 97bb45f4076083fca037eee15d001fd284e53e47 |
| SHA256 | 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be |
| SHA512 | b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877 |
C:\Users\Admin\AppData\Local\Temp\v.mp4
| MD5 | d2774b188ab5dde3e2df5033a676a0b4 |
| SHA1 | 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc |
| SHA256 | 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443 |
| SHA512 | 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131 |
memory/2920-30-0x0000000000AD0000-0x0000000000ADA000-memory.dmp
memory/2920-29-0x0000000000AD0000-0x0000000000ADA000-memory.dmp
memory/2920-28-0x0000000000AD0000-0x0000000000ADA000-memory.dmp
memory/2920-27-0x0000000000AD0000-0x0000000000ADA000-memory.dmp
memory/2920-26-0x000000006B9E0000-0x000000006BCF2000-memory.dmp
memory/2920-31-0x0000000000AF0000-0x0000000000AFA000-memory.dmp
memory/2920-32-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\text.txt
| MD5 | 9037ebf0a18a1c17537832bc73739109 |
| SHA1 | 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60 |
| SHA256 | 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48 |
| SHA512 | 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f |
C:\Users\Admin\AppData\Local\Temp\one.rtf
| MD5 | 6fbd6ce25307749d6e0a66ebbc0264e7 |
| SHA1 | faee71e2eac4c03b96aabecde91336a6510fff60 |
| SHA256 | e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690 |
| SHA512 | 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064 |
memory/2108-838-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
memory/2920-839-0x0000000074A50000-0x000000007513E000-memory.dmp
memory/2920-840-0x00000000050E0000-0x0000000005120000-memory.dmp
memory/2920-842-0x0000000000BE0000-0x0000000000BE5000-memory.dmp
memory/2920-841-0x000000006B9E0000-0x000000006BCF2000-memory.dmp
memory/472-843-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
Analysis: behavioral10
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20240226-en
Max time kernel
66s
Max time network
87s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 172.217.169.10:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 10.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
Files
Analysis: behavioral20
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:31
Platform
win10v2004-20231215-en
Max time kernel
8s
Max time network
77s
Command Line
Signatures
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation | C:\WINDOWS\302746537.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| N/A | N/A | C:\WINDOWS\302746537.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe | N/A |
Drops file in Windows directory
Enumerates physical storage devices
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\VersionIndependentProgID\ = "COMCTL.Slider" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}\ = "ImageList General Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Version | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\CLSID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\ = "Panel Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32\ = "c:\\windows\\comctl32.ocx" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\ = "IToolbar" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.ListViewCtrl.1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\ = "Toolbar General Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\ = "IToolbar" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\ = "Microsoft Slider Control, version 5.0 (SP2)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\ = "Microsoft Windows Common Controls 5.0 (SP2)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 12" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer\ = "COMCTL.Toolbar.1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1\CLSID\ = "{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\ = "Microsoft ProgressBar Control, version 5.0 (SP2)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObject" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CurVer\ = "COMCTL.TabStrip.1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.SBarCtrl" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Programmable | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\0\win32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl\CLSID\ = "{0713E8A2-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ = "ITabStrip" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Runs net.exe
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B01.tmp\5B02.tmp\5B03.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
FreeMicrosoft.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
AntivirusPlatinum.exe
C:\Windows\system32\timeout.exe
timeout /t 2
C:\WINDOWS\302746537.exe
"C:\WINDOWS\302746537.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\76E5.tmp\302746537.bat" "
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\comctl32.ocx
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\mscomctl.ocx
\??\c:\windows\antivirus-platinum.exe
c:\windows\antivirus-platinum.exe
C:\Windows\SysWOW64\attrib.exe
attrib +h c:\windows\antivirus-platinum.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
Antivirus.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\taskkill.exe
taskkill /IM lsass.exe /F
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
Badgame.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
Hydra.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
SGen.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\timeout.exe
timeout /t 10
C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC7FCF.tmp.vbs"
C:\Windows\SysWOW64\net.exe
net stop wscsvc
C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
C:\Windows\SysWOW64\net.exe
net start winmgmt
C:\Windows\SysWOW64\net.exe
net start wscsvc
C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start wscsvc
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
PCOptimizerProInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
VirusCan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
matrix.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
bomb.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AF99.tmp\VirusCan.bat""
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
ChilledWindows.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B0C2.tmp\B0C3.tmp\B0C4.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x498
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 178.223.142.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\5B01.tmp\5B02.tmp\5B03.bat
| MD5 | 9eed2c0c3293d9424e3edacf3b36615d |
| SHA1 | 1d7743263a25661055549dd913ec5c654fa99ffd |
| SHA256 | 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2 |
| SHA512 | cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746 |
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
| MD5 | 833619a4c9e8c808f092bf477af62618 |
| SHA1 | b4a0efa26f790e991cb17542c8e6aeb5030d1ebf |
| SHA256 | 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76 |
| SHA512 | 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11 |
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
| MD5 | 382430dd7eae8945921b7feab37ed36b |
| SHA1 | c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128 |
| SHA256 | 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b |
| SHA512 | 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b |
C:\Windows\302746537.exe
| MD5 | 8703ff2e53c6fd3bc91294ef9204baca |
| SHA1 | 3dbb8f7f5dfe6b235486ab867a2844b1c2143733 |
| SHA256 | 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035 |
| SHA512 | d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204 |
memory/2240-53-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\76E5.tmp\302746537.bat
| MD5 | 7d8beb22dfcfacbbc2609f88a41c1458 |
| SHA1 | 52ec2b10489736b963d39a9f84b66bafbf15685f |
| SHA256 | 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2 |
| SHA512 | a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94 |
C:\Windows\COMCTL32.OCX
| MD5 | 821511549e2aaf29889c7b812674d59b |
| SHA1 | 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6 |
| SHA256 | f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4 |
| SHA512 | 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd |
\??\c:\windows\mscomctl.ocx
| MD5 | 714cf24fc19a20ae0dc701b48ded2cf6 |
| SHA1 | d904d2fa7639c38ffb6e69f1ef779ca1001b8c18 |
| SHA256 | 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712 |
| SHA512 | d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1 |
\??\c:\windows\antivirus-platinum.exe
| MD5 | cd1800322ccfc425014a8394b01a4b3d |
| SHA1 | 171073975effde1c712dfd86309457fd457aed33 |
| SHA256 | 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0 |
| SHA512 | 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6 |
memory/2284-65-0x0000000000400000-0x000000000040D000-memory.dmp
memory/2240-68-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
| MD5 | c7e9746b1b039b8bd1106bca3038c38f |
| SHA1 | cb93ac887876bafe39c5f9aa64970d5e747fb191 |
| SHA256 | b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4 |
| SHA512 | cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724 |
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
| MD5 | 979b597855746aee2f30ee74f9d7c163 |
| SHA1 | 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f |
| SHA256 | dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11 |
| SHA512 | 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e |
memory/2676-80-0x0000000000110000-0x0000000000118000-memory.dmp
memory/748-81-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/2676-82-0x0000000004E90000-0x0000000005434000-memory.dmp
memory/3592-83-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/748-84-0x0000000005540000-0x00000000055D2000-memory.dmp
memory/2676-85-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/2676-86-0x00000000049C0000-0x00000000049D0000-memory.dmp
memory/748-87-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3592-88-0x0000000005650000-0x0000000005660000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
| MD5 | ebfbd478a8cfc0fb645b8559973690cb |
| SHA1 | 88ec8dff51b53beed128582bcaf86ea81f684a0f |
| SHA256 | 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59 |
| SHA512 | 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82 |
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/3588-118-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4284-102-0x0000000000D10000-0x0000000000D20000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
| MD5 | b2eca909a91e1946457a0b36eaf90930 |
| SHA1 | 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa |
| SHA256 | 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c |
| SHA512 | 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf |
memory/2388-120-0x0000000073650000-0x0000000073E00000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\SFC7FCF.tmp.vbs
| MD5 | c9f89015e169c812c60401d74883575f |
| SHA1 | 213bb6cde1d5930dcfa5e5584e42d52c4d160108 |
| SHA256 | 77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056 |
| SHA512 | c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e |
memory/4284-119-0x0000000005760000-0x000000000576A000-memory.dmp
memory/4888-122-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4284-123-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/3736-124-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4108-125-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4424-126-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4460-127-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4512-128-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4796-129-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4984-130-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/3960-131-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4632-132-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/3588-133-0x0000000004F20000-0x0000000004F30000-memory.dmp
memory/3164-134-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/2364-135-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/3928-136-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4284-140-0x0000000005790000-0x00000000057A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
| MD5 | 7fad92afda308dca8acfc6ff45c80c24 |
| SHA1 | a7fa35e7f90f772fc943c2e940737a48b654c295 |
| SHA256 | 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f |
| SHA512 | 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea |
memory/2284-143-0x0000000000400000-0x000000000040D000-memory.dmp
memory/3792-144-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
| MD5 | 908e9673e2042fa83264dd3697b05938 |
| SHA1 | 4820e77be59c55c4b0193f905550eae101bcec5a |
| SHA256 | d2c98f605bd579d0c31609dddcf2ba0a4165b4ea62f3f414969d27030626c6ae |
| SHA512 | a220201be5c944aa556574294b0565757f230e783dc86d0a3a66abafa224692a8c55b97f5b7c9660052400e27e3b7ef58b479805ac83e75ef63d86c75cf50dc0 |
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
| MD5 | 8edb51ed1d3241c4f026bb0d5de20f89 |
| SHA1 | 9453b850f98062c0b3955a58c295a662be605efb |
| SHA256 | c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47 |
| SHA512 | 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2 |
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
| MD5 | 83726a8767faba50ea1b5f31afef5938 |
| SHA1 | 70165dcc633f3390d98ae08c731113b007069737 |
| SHA256 | e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4 |
| SHA512 | e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301 |
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
| MD5 | 8a7696d03fb78dc2e689fd8871a8477e |
| SHA1 | 7b56ac50ba278aae9898187b922b41282e18d50b |
| SHA256 | 28dc37162607eee58f2fe04eb3f05fcd15d16a9ca4325a46f71737add1afb530 |
| SHA512 | 6a6fddaebea531345a9a3758adf50fc77301930ed7d649b19db8e42ff3211e14e6a7846f98ada86a8cd50af4b7316c0423e9cf989a04b375d7c26ed88e99befd |
C:\Users\Admin\AppData\Local\Temp\nskAD67.tmp\GetVersion.dll
| MD5 | dc9562578490df8bc464071f125bfc19 |
| SHA1 | 56301a36ae4e3f92883f89f86b5d04da1e52770d |
| SHA256 | 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f |
| SHA512 | 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321 |
C:\Users\Admin\AppData\Local\Temp\nskAD67.tmp\LangDLL.dll
| MD5 | de3558ce305e32f742ff25b697407fec |
| SHA1 | d55c50c546001421647f2e91780c324dbb8d6ebb |
| SHA256 | 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a |
| SHA512 | 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac |
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
| MD5 | 072b51035a457758506c56b3664c0c66 |
| SHA1 | bb94305373f963aef82c6f61476d8ae6925585a3 |
| SHA256 | 23e388a2c761380b0ed0754280b288c34dfb131c53195bcee1467dc80d71533e |
| SHA512 | 3d822d54901f452b0b2b22d68da66fabbe201ebe4529267850f11702b78aa324a0fd99ba7ec1b6a581886fc90d2feea0e7b7145aaee92a7e9459d12d0305a423 |
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
| MD5 | 7fb48df389c7785b50e5341b5a7a363d |
| SHA1 | 7c78e8a9a9b0a44508bc94ca51a782df84440cff |
| SHA256 | 80e50768e428fa4cfaacce15e49d3cf339afcc68ee6afd285ac62dc537076583 |
| SHA512 | 5c347dff392a62402e80bac29f6794acdec6d65826e536889fa1d6779e8f2499baa2bf97b8704c4b28ea540756295d50b7c049e95749919c17e14dc97f56e249 |
memory/1444-169-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3756-170-0x000000006FA10000-0x000000006FA19000-memory.dmp
memory/3592-175-0x0000000073650000-0x0000000073E00000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
| MD5 | ea8efbe8077e302836c786a2c3c1f98d |
| SHA1 | 6dbb29e048d5d7afbd8587dbe189bdb037b7506a |
| SHA256 | 18eca01f8c92c7ff269182cbe7f7b5cb27aaa7ab634eeb30e90a93e6639a67ca |
| SHA512 | a142caea844fb7a696f76097fcdf1510ab5e5b5e7f217a6e05b643934f78db7a794fd8026a5360da807585fa24881ccd7e017ecc3ad5c2acf673c9541cb480bd |
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
| MD5 | 73f6e5060efef6f832e0e36b91ee1dc5 |
| SHA1 | 0ae9a0a4984181ceb43ad01a75c106c8bae8b669 |
| SHA256 | 8ae13b05b060bfb6dbc5bb5cf98aa8611d9ad80b433f0bda97e88dddfb53c8b4 |
| SHA512 | 536e45c9baae2d3e28f13a0318614b8effcf9660c7143a9a878e46a62b0e408c8b7e25f549160d8fec6cb11a9b12fd52b98a8cc7d9297861a85ed6b0530ccf8f |
C:\Users\Admin\AppData\Local\Temp\AF99.tmp\VirusCan.bat
| MD5 | 55dcde25c122c782757989a3c275fea2 |
| SHA1 | a669581a58e6aa602cbdaf690e3e365fa4de570f |
| SHA256 | 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916 |
| SHA512 | b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2 |
memory/4716-181-0x0000000000940000-0x0000000000DA4000-memory.dmp
memory/4392-182-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/1444-183-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp\B0C3.tmp\B0C4.bat
| MD5 | d03b3332e0eb70b0f9a987cabe089c17 |
| SHA1 | 7d27ee89e5e7f02544728d9f5d227945eba76e56 |
| SHA256 | 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88 |
| SHA512 | 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0 |
memory/748-185-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/2676-186-0x0000000073650000-0x0000000073E00000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
| MD5 | 7050d5ae8acfbe560fa11073fef8185d |
| SHA1 | 5bc38e77ff06785fe0aec5a345c4ccd15752560e |
| SHA256 | cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b |
| SHA512 | a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b |
memory/4716-193-0x00007FFD38850000-0x00007FFD39311000-memory.dmp
memory/4716-199-0x000000001BB10000-0x000000001BB18000-memory.dmp
memory/4716-200-0x000000001BB80000-0x000000001BB90000-memory.dmp
memory/2676-201-0x00000000049C0000-0x00000000049D0000-memory.dmp
memory/748-202-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3592-203-0x0000000005650000-0x0000000005660000-memory.dmp
memory/4716-204-0x0000000021B00000-0x0000000021B38000-memory.dmp
memory/4716-206-0x000000001D420000-0x000000001D42E000-memory.dmp
memory/3588-205-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/2388-208-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4284-209-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/3736-211-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4716-212-0x000000001BB80000-0x000000001BB90000-memory.dmp
memory/1444-213-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | c577a44eebcc39c126bf5e167727e951 |
| SHA1 | 78a17464f66089930b707ba7a59dc0074f473e69 |
| SHA256 | cafc0b2ebc3c462e93f0bae0446b9c1f4fc801879afb3003e247f7c9aca081c0 |
| SHA512 | 223d16dd064d25a70e6796512f9e7fb5e6a0d4c967feffe6028487880c2cfa2f3eba43032152965483b21bc2089d5b934da5e8366745cdde957cb7e21dbbbf3b |
C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4
| MD5 | e816c90cfea202a5ce7e1d47d77d5944 |
| SHA1 | 13e7c34f464b96d82c8f3486407cc91c790a8977 |
| SHA256 | 74546d52df759ed676fcb45dcdb2789dd2ac0795743278ec2a167e7889b8336d |
| SHA512 | 54e9a85af039a541c7cc144c8f2c1776aa27892aa6e82aff9ee73695719650c84c664ffb13f28c09e9013325c3dc87ccc37a419b67ef19660efb2b7dc42b3541 |
memory/4888-231-0x0000000073650000-0x0000000073E00000-memory.dmp
memory/4284-233-0x0000000005790000-0x00000000057A0000-memory.dmp
memory/4888-234-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/3960-235-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/2388-236-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/3164-237-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/4284-242-0x0000000005790000-0x00000000057A0000-memory.dmp
memory/3756-246-0x000000006FA10000-0x000000006FA19000-memory.dmp
memory/4716-260-0x00007FFD38850000-0x00007FFD39311000-memory.dmp
memory/3756-261-0x000000006FA10000-0x000000006FA19000-memory.dmp
Analysis: behavioral21
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
122s
Max time network
129s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2712 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2712 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2712 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2712 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\232A.tmp\232B.tmp\232C.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\232A.tmp\232B.tmp\232C.bat
| MD5 | ffa0ad441b308bc1da589f8a734e806f |
| SHA1 | 704fc5c8773489b91d2f1ef221ab60ecd3257e3e |
| SHA256 | c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1 |
| SHA512 | bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b |
Analysis: behavioral29
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:31
Platform
win7-20240221-en
Max time kernel
29s
Max time network
41s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
Files
memory/2176-0-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2832-1-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/2108-2-0x0000000002760000-0x0000000002761000-memory.dmp
Analysis: behavioral30
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:31
Platform
win10v2004-20240226-en
Max time kernel
30s
Max time network
62s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a4855 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.169.74:443 | tcp | |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 11.179.89.13.in-addr.arpa | udp |
Files
memory/3536-0-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20240226-en
Max time kernel
146s
Max time network
155s
Command Line
Signatures
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Disables Task Manager via registry modification
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
System policy modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" | C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:30
Platform
win10v2004-20240226-en
Max time kernel
3s
Max time network
23s
Command Line
Signatures
Disables Task Manager via registry modification
Enumerates connected drives
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{61D4B863-DFFD-4205-8353-457069CA3505} | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='UR NEXT'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'UR NEXT'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bd855 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.201.86.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 138.91.171.81:80 | tcp |
Files
memory/4480-0-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4480-1-0x0000000000930000-0x0000000000FDE000-memory.dmp
memory/4480-2-0x0000000005A40000-0x0000000005A50000-memory.dmp
memory/4480-3-0x0000000006070000-0x0000000006614000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\windl.bat
| MD5 | a9401e260d9856d1134692759d636e92 |
| SHA1 | 4141d3c60173741e14f36dfe41588bb2716d2867 |
| SHA256 | b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7 |
| SHA512 | 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6 |
memory/4480-11-0x0000000005A40000-0x0000000005A50000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
| MD5 | 7050d5ae8acfbe560fa11073fef8185d |
| SHA1 | 5bc38e77ff06785fe0aec5a345c4ccd15752560e |
| SHA256 | cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b |
| SHA512 | a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b |
memory/4480-22-0x000000000C390000-0x000000000C3C8000-memory.dmp
memory/4480-23-0x000000000B900000-0x000000000B90E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rniw.exe
| MD5 | 9232120b6ff11d48a90069b25aa30abc |
| SHA1 | 97bb45f4076083fca037eee15d001fd284e53e47 |
| SHA256 | 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be |
| SHA512 | b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877 |
memory/4480-29-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-30-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-32-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-34-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-35-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-36-0x000000000CA50000-0x000000000CA60000-memory.dmp
memory/4480-37-0x000000000CA50000-0x000000000CA60000-memory.dmp
memory/4480-39-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-40-0x000000000CA50000-0x000000000CA60000-memory.dmp
memory/4480-41-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-42-0x000000000CA50000-0x000000000CA60000-memory.dmp
memory/4480-38-0x000000000C3D0000-0x000000000C3E0000-memory.dmp
memory/4480-43-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4480-44-0x000000000CA50000-0x000000000CA60000-memory.dmp
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
| MD5 | 9037ebf0a18a1c17537832bc73739109 |
| SHA1 | 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60 |
| SHA256 | 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48 |
| SHA512 | 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f |
C:\Users\Admin\AppData\Local\Temp\one.rtf
| MD5 | 6fbd6ce25307749d6e0a66ebbc0264e7 |
| SHA1 | faee71e2eac4c03b96aabecde91336a6510fff60 |
| SHA256 | e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690 |
| SHA512 | 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064 |
memory/4480-863-0x00000000749C0000-0x0000000075170000-memory.dmp
Analysis: behavioral16
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20240226-en
Max time kernel
44s
Max time network
116s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1576 -ip 1576
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 488
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
Files
memory/1576-0-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1576-1-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral31
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
117s
Max time network
146s
Command Line
Signatures
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2344 wrote to memory of 2984 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
| PID 2344 wrote to memory of 2984 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
| PID 2344 wrote to memory of 2984 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BE8E.tmp\BE8F.tmp\BE90.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp\BE8F.tmp\BE90.bat
| MD5 | f2d5cf0bf3d6ec8c6d5dc97af835c5e5 |
| SHA1 | 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6 |
| SHA256 | 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c |
| SHA512 | 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9 |
Analysis: behavioral32
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20240226-en
Max time kernel
145s
Max time network
154s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3960 wrote to memory of 1656 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
| PID 3960 wrote to memory of 1656 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\54C7.tmp\54C8.tmp\54C9.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.177.78.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 68.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\54C7.tmp\54C8.tmp\54C9.bat
| MD5 | f2d5cf0bf3d6ec8c6d5dc97af835c5e5 |
| SHA1 | 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6 |
| SHA256 | 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c |
| SHA512 | 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:34
Platform
win10v2004-20240226-en
Max time kernel
145s
Max time network
193s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1276 wrote to memory of 3888 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe | C:\Windows\system32\cmd.exe |
| PID 1276 wrote to memory of 3888 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1095.tmp\1096.tmp\1097.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 5.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\1095.tmp\1096.tmp\1097.bat
| MD5 | cffeffdd19a93f72fce9ae0b27fc7d41 |
| SHA1 | d51f874d7e1dbce87a6615db19e3bb3cd7918050 |
| SHA256 | f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc |
| SHA512 | 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b |
Analysis: behavioral15
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
3s
Max time network
14s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
Network
Files
Analysis: behavioral25
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:32
Platform
win7-20240221-en
Max time kernel
69s
Max time network
90s
Command Line
Signatures
Disables Task Manager via registry modification
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='No System Anymore'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'No System Anymore'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
Files
memory/2536-0-0x0000000000EE0000-0x00000000015AA000-memory.dmp
memory/2536-1-0x00000000746A0000-0x0000000074D8E000-memory.dmp
memory/2536-2-0x00000000053D0000-0x0000000005410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\z666.bat
| MD5 | ee655674ba8e05d5a4c32de58a6757c1 |
| SHA1 | f06f54710d5a0b341a9e6d467e1bb1a78f2f9606 |
| SHA256 | 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef |
| SHA512 | 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd |
C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe
| MD5 | ef4e8ea4440efc48d5cd1a05a3a6f2a8 |
| SHA1 | 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068 |
| SHA256 | b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709 |
| SHA512 | f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4 |
C:\Users\Admin\AppData\Local\Temp\bsod.exe
| MD5 | f1896231e9622dd044601962a9866a77 |
| SHA1 | 36ad39e7d797ae43ee415e90a2dc234e0be3087b |
| SHA256 | a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8 |
| SHA512 | e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901 |
memory/2536-22-0x00000000053D0000-0x0000000005410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\noway.txt
| MD5 | 391403276c6df4a164b0544a3411c6c7 |
| SHA1 | c4c06a4c7710d1d8140b07abd4b7bcd4187485ab |
| SHA256 | 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b |
| SHA512 | 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8 |
memory/1716-825-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/2536-824-0x00000000746A0000-0x0000000074D8E000-memory.dmp
memory/2272-826-0x0000000002760000-0x0000000002761000-memory.dmp
memory/2536-827-0x00000000053D0000-0x0000000005410000-memory.dmp
Analysis: behavioral28
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:34
Platform
win10v2004-20240226-en
Max time kernel
183s
Max time network
157s
Command Line
Signatures
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3088 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3088 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3088 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2880 wrote to memory of 4000 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2880 wrote to memory of 4000 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2880 wrote to memory of 4000 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\240668828.bat" "
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 21.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.179.89.13.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\240668828.bat
| MD5 | 2e90ad588f5329388216c652eebd4a33 |
| SHA1 | baa4f47ee4f195d854f8db905fcbb2539556f0e0 |
| SHA256 | 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac |
| SHA512 | b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778 |
memory/3088-2-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral9
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240215-en
Max time kernel
0s
Max time network
5s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"
Network
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
118s
Max time network
131s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
Files
memory/2728-0-0x0000000000400000-0x0000000000412000-memory.dmp
Analysis: behavioral24
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:34
Platform
win10v2004-20240226-en
Max time kernel
142s
Max time network
190s
Command Line
Signatures
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 380 wrote to memory of 2968 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 380 wrote to memory of 2968 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 380 wrote to memory of 2968 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2968 wrote to memory of 3512 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 2968 wrote to memory of 3512 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 2968 wrote to memory of 3512 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\240652156.bat" "
C:\Windows\SysWOW64\cscript.exe
cscript [regtaskmgr.vbs]
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.143.182.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\240652156.bat
| MD5 | 826431d3df1879172a96555d7ba0aeef |
| SHA1 | f56ff5d3c06f78f53884071d1357ba79ee85b96e |
| SHA256 | e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee |
| SHA512 | e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52 |
memory/380-2-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral7
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
97s
Max time network
17s
Command Line
Signatures
Possible privilege escalation attempt
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Temp\winconfig.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\DetectKey.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Modifies file permissions
Modifies boot configuration data using bcdedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\DetectKey.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"
C:\Windows\Temp\winconfig.exe
"C:\Windows\Temp\winconfig.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\43F3.tmp\43F4.tmp\43F5.bat C:\Windows\Temp\winconfig.exe"
C:\Users\Admin\AppData\Roaming\DetectKey.exe
"C:\Users\Admin\AppData\Roaming\DetectKey.exe"
C:\Windows\system32\bcdedit.exe
bcdedit /delete {current}
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='mmc.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='PartAssist.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='control.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='CCleaner.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='procexp64a.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='regedit.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='iexplore.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='chrome.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='firefox.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='opera.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='edge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='msedge.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='brave.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='wmplayer.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='notepad++.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskmgr.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\hal.dll"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\winload.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\ntoskrnl.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\perfmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\resmon.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\taskkill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tasklist.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\tskill.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\logonui.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\Program Files\Process Hacker 2"
C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\drivers"
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='perfmon.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='ProcessHacker.exe' delete /nointeractive
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
C:\Windows\system32\cacls.exe
cacls "C:\Windows\System32\drivers" /grant "everyone":F
C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T
Network
Files
\Windows\Temp\winconfig.exe
| MD5 | 11d457ee914f72a436fa4a8a8f8446dd |
| SHA1 | d0308ca82ed9716b667e8e77e9ae013b9af44116 |
| SHA256 | c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef |
| SHA512 | 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b |
C:\Users\Admin\AppData\Local\Temp\43F3.tmp\43F4.tmp\43F5.bat
| MD5 | a645734f3bf4a2682cbaf546789ec0c4 |
| SHA1 | fafcc11909412bf51f217e12dfaa93a15181a3e2 |
| SHA256 | 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0 |
| SHA512 | efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d |
C:\Users\Admin\AppData\Roaming\DetectKey.exe
| MD5 | aba9a3cf4e1db4602c25405987b809a6 |
| SHA1 | 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80 |
| SHA256 | 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6 |
| SHA512 | e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675 |
Analysis: behavioral17
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
7s
Max time network
20s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
Network
Files
memory/2248-1-0x0000000001360000-0x0000000001378000-memory.dmp
memory/2248-0-0x0000000074700000-0x0000000074DEE000-memory.dmp
memory/2248-2-0x0000000000610000-0x0000000000650000-memory.dmp
Analysis: behavioral18
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20240226-en
Max time kernel
7s
Max time network
16s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2448 wrote to memory of 3416 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
| PID 2448 wrote to memory of 3416 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
| PID 2448 wrote to memory of 3416 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"
C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3416 -ip 3416
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 496
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
Files
memory/2448-0-0x0000000000650000-0x0000000000668000-memory.dmp
memory/2448-1-0x0000000075330000-0x0000000075AE0000-memory.dmp
memory/2448-2-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/2448-3-0x0000000005040000-0x00000000050D2000-memory.dmp
memory/2448-4-0x0000000005260000-0x0000000005270000-memory.dmp
memory/2448-5-0x0000000005010000-0x000000000501A000-memory.dmp
Analysis: behavioral27
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:34
Platform
win7-20240221-en
Max time kernel
195s
Max time network
34s
Command Line
Signatures
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2584 wrote to memory of 2476 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2584 wrote to memory of 2476 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2584 wrote to memory of 2476 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2584 wrote to memory of 2476 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2476 wrote to memory of 2932 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2476 wrote to memory of 2932 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2476 wrote to memory of 2932 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 2476 wrote to memory of 2932 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\taskkill.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\259504855.bat" "
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM explorer.exe
Network
Files
C:\Users\Admin\AppData\Local\Temp\259504855.bat
| MD5 | 2e90ad588f5329388216c652eebd4a33 |
| SHA1 | baa4f47ee4f195d854f8db905fcbb2539556f0e0 |
| SHA256 | 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac |
| SHA512 | b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778 |
memory/2476-12-0x00000000021B0000-0x00000000021B1000-memory.dmp
memory/2584-17-0x0000000000400000-0x0000000000407000-memory.dmp
memory/2476-19-0x00000000021B0000-0x00000000021B1000-memory.dmp
Analysis: behavioral13
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
118s
Max time network
148s
Command Line
Signatures
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"
C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im lsass.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
Files
memory/2832-0-0x00000000008F0000-0x0000000000916000-memory.dmp
memory/2832-1-0x0000000074920000-0x000000007500E000-memory.dmp
memory/2832-2-0x0000000074920000-0x000000007500E000-memory.dmp
memory/2832-3-0x0000000005360000-0x00000000053A0000-memory.dmp
memory/1560-4-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2832-5-0x0000000005360000-0x00000000053A0000-memory.dmp
Analysis: behavioral14
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:32
Platform
win10v2004-20240226-en
Max time kernel
69s
Max time network
100s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe | N/A |
Enumerates physical storage devices
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 116 wrote to memory of 3288 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 116 wrote to memory of 3288 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 116 wrote to memory of 3288 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Windows\SysWOW64\taskkill.exe |
| PID 116 wrote to memory of 112 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe |
| PID 116 wrote to memory of 112 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe |
| PID 116 wrote to memory of 112 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"
C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im lsass.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
Files
memory/116-0-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/116-1-0x00000000005C0000-0x00000000005E6000-memory.dmp
memory/116-2-0x0000000005530000-0x0000000005AD4000-memory.dmp
memory/116-3-0x0000000005020000-0x00000000050B2000-memory.dmp
memory/116-4-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/116-5-0x0000000005000000-0x000000000500A000-memory.dmp
memory/112-6-0x0000000000400000-0x0000000000412000-memory.dmp
memory/116-7-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/116-8-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
Analysis: behavioral23
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
119s
Max time network
124s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2248 wrote to memory of 1760 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2248 wrote to memory of 1760 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2248 wrote to memory of 1760 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 2248 wrote to memory of 1760 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 1760 wrote to memory of 2572 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 1760 wrote to memory of 2572 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 1760 wrote to memory of 2572 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
| PID 1760 wrote to memory of 2572 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\SysWOW64\cscript.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"
C:\Windows\SysWOW64\cmd.exe
/c ""C:\Users\Admin\AppData\Local\Temp\259400428.bat" "
C:\Windows\SysWOW64\cscript.exe
cscript [regtaskmgr.vbs]
Network
Files
C:\Users\Admin\AppData\Local\Temp\259400428.bat
| MD5 | 826431d3df1879172a96555d7ba0aeef |
| SHA1 | f56ff5d3c06f78f53884071d1357ba79ee85b96e |
| SHA256 | e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee |
| SHA512 | e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52 |
memory/1760-12-0x0000000000410000-0x0000000000411000-memory.dmp
memory/2248-34-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral26
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:31
Platform
win10v2004-20240226-en
Max time kernel
52s
Max time network
66s
Command Line
Signatures
Disables Task Manager via registry modification
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "109" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='No System Anymore'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'No System Anymore'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa399e855 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
Files
memory/2568-0-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/2568-1-0x00000000004F0000-0x0000000000BBA000-memory.dmp
memory/2568-2-0x0000000005B70000-0x0000000006114000-memory.dmp
memory/2568-3-0x0000000005660000-0x00000000056F2000-memory.dmp
memory/2568-4-0x00000000058E0000-0x00000000058F0000-memory.dmp
memory/2568-5-0x00000000055C0000-0x00000000055CA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\z666.bat
| MD5 | ee655674ba8e05d5a4c32de58a6757c1 |
| SHA1 | f06f54710d5a0b341a9e6d467e1bb1a78f2f9606 |
| SHA256 | 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef |
| SHA512 | 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd |
C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe
| MD5 | ef4e8ea4440efc48d5cd1a05a3a6f2a8 |
| SHA1 | 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068 |
| SHA256 | b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709 |
| SHA512 | f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4 |
C:\Users\Admin\AppData\Local\Temp\bsod.exe
| MD5 | f1896231e9622dd044601962a9866a77 |
| SHA1 | 36ad39e7d797ae43ee415e90a2dc234e0be3087b |
| SHA256 | a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8 |
| SHA512 | e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901 |
memory/2568-20-0x00000000058E0000-0x00000000058F0000-memory.dmp
memory/2568-21-0x0000000074DC0000-0x0000000075570000-memory.dmp
memory/2568-22-0x00000000058E0000-0x00000000058F0000-memory.dmp
memory/2568-23-0x00000000058E0000-0x00000000058F0000-memory.dmp
C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt
| MD5 | 391403276c6df4a164b0544a3411c6c7 |
| SHA1 | c4c06a4c7710d1d8140b07abd4b7bcd4187485ab |
| SHA256 | 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b |
| SHA512 | 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8 |
memory/2568-825-0x0000000074DC0000-0x0000000075570000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win7-20240221-en
Max time kernel
117s
Max time network
149s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1048 wrote to memory of 2232 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe | C:\Windows\system32\cmd.exe |
| PID 1048 wrote to memory of 2232 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe | C:\Windows\system32\cmd.exe |
| PID 1048 wrote to memory of 2232 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EA1.tmp\EA2.tmp\EA3.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\EA1.tmp\EA2.tmp\EA3.bat
| MD5 | cffeffdd19a93f72fce9ae0b27fc7d41 |
| SHA1 | d51f874d7e1dbce87a6615db19e3bb3cd7918050 |
| SHA256 | f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc |
| SHA512 | 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b |
Analysis: behavioral22
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:33
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
156s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2340 wrote to memory of 4572 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
| PID 2340 wrote to memory of 4572 | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\48D0.tmp\48E1.tmp\48E2.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.181.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.177.78.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 50.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.179.17.96.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\48D0.tmp\48E1.tmp\48E2.bat
| MD5 | ffa0ad441b308bc1da589f8a734e806f |
| SHA1 | 704fc5c8773489b91d2f1ef221ab60ecd3257e3e |
| SHA256 | c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1 |
| SHA512 | bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b |
Analysis: behavioral19
Detonation Overview
Submitted
2024-03-16 17:15
Reported
2024-03-16 19:31
Platform
win7-20240215-en
Max time kernel
69s
Max time network
50s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe | N/A |
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\AnVi\splash.mp3 | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| File created | C:\Program Files (x86)\AnVi\virus.mp3 | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\__tmp_rar_sfx_access_check_259406714 | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\antivirus-platinum.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\antivirus-platinum.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\COMCTL32.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\windows\antivirus-platinum.exe | C:\Windows\SysWOW64\attrib.exe | N/A |
| File opened for modification | C:\Windows\COMCTL32.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\MSCOMCTL.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\MSCOMCTL.OCX | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File created | C:\Windows\302746537.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
| File opened for modification | C:\Windows\302746537.exe | C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe | N/A |
Enumerates physical storage devices
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main | \??\c:\windows\antivirus-platinum.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main | \??\c:\windows\antivirus-platinum.exe | N/A |
Modifies Internet Explorer start page
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan" | \??\c:\windows\antivirus-platinum.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "165265" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\MiscStatus | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\ = "ITabStripEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\ = "IStatusBarEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D91-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "131473" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl\CurVer\ = "MSComctlLib.SBarCtrl.2" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus\1\ = "131473" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Programmable | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\ = "IButtonMenus" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32\ = "c:\\windows\\comctl32.ocx" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\ = "StatusBar General Property Page Object" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl.2 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeader11" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ = "Microsoft StatusBar Control 6.0 (SP4)" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ = "IListItems" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID\ = "{6B7E638F-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Runs net.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" | \??\c:\windows\antivirus-platinum.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer | \??\c:\windows\antivirus-platinum.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" | \??\c:\windows\antivirus-platinum.exe | N/A |
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\22CC.tmp\22CD.tmp\22CE.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"
C:\Windows\system32\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
FreeMicrosoft.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
AntivirusPlatinum.exe
C:\Windows\system32\timeout.exe
timeout /t 2
C:\WINDOWS\302746537.exe
"C:\WINDOWS\302746537.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\3BD8.tmp\302746537.bat" "
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\comctl32.ocx
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\mscomctl.ocx
\??\c:\windows\antivirus-platinum.exe
c:\windows\antivirus-platinum.exe
C:\Windows\SysWOW64\attrib.exe
attrib +h c:\windows\antivirus-platinum.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
Antivirus.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\taskkill.exe
taskkill /IM lsass.exe /F
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
Badgame.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
Hydra.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
SGen.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC43F3.tmp.vbs"
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
runaway.exe
C:\Windows\system32\timeout.exe
timeout /t 10
C:\Windows\SysWOW64\net.exe
net stop wscsvc
C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
C:\Windows\SysWOW64\net.exe
net start winmgmt
C:\Windows\SysWOW64\net.exe
net start wscsvc
C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start wscsvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
Melting.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
PCOptimizerProInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
VirusCan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
matrix.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
bomb.exe
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
ChilledWindows.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\70EC.tmp\70ED.tmp\70EE.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7233.tmp\VirusCan.bat""
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1652 -s 652
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | frequentwin.com | udp |
| US | 8.8.8.8:53 | searchdusty.com | udp |
| CA | 54.39.157.64:80 | searchdusty.com | tcp |
| US | 8.8.8.8:53 | fastsofgeld.com | udp |
| US | 8.8.8.8:53 | highway-traffic.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\22CC.tmp\22CD.tmp\22CE.bat
| MD5 | 9eed2c0c3293d9424e3edacf3b36615d |
| SHA1 | 1d7743263a25661055549dd913ec5c654fa99ffd |
| SHA256 | 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2 |
| SHA512 | cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746 |
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
| MD5 | 833619a4c9e8c808f092bf477af62618 |
| SHA1 | b4a0efa26f790e991cb17542c8e6aeb5030d1ebf |
| SHA256 | 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76 |
| SHA512 | 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11 |
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
| MD5 | 382430dd7eae8945921b7feab37ed36b |
| SHA1 | c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128 |
| SHA256 | 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b |
| SHA512 | 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b |
memory/2660-43-0x00000000004D0000-0x00000000004D6000-memory.dmp
C:\Windows\302746537.exe
| MD5 | 8703ff2e53c6fd3bc91294ef9204baca |
| SHA1 | 3dbb8f7f5dfe6b235486ab867a2844b1c2143733 |
| SHA256 | 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035 |
| SHA512 | d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204 |
memory/2880-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2660-46-0x0000000002200000-0x0000000002210000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp\302746537.bat
| MD5 | 7d8beb22dfcfacbbc2609f88a41c1458 |
| SHA1 | 52ec2b10489736b963d39a9f84b66bafbf15685f |
| SHA256 | 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2 |
| SHA512 | a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94 |
\??\c:\windows\comctl32.ocx
| MD5 | 821511549e2aaf29889c7b812674d59b |
| SHA1 | 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6 |
| SHA256 | f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4 |
| SHA512 | 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd |
\??\c:\windows\mscomctl.ocx
| MD5 | 714cf24fc19a20ae0dc701b48ded2cf6 |
| SHA1 | d904d2fa7639c38ffb6e69f1ef779ca1001b8c18 |
| SHA256 | 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712 |
| SHA512 | d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1 |
memory/1580-68-0x0000000000280000-0x000000000028D000-memory.dmp
memory/1556-70-0x0000000000400000-0x000000000040D000-memory.dmp
C:\Windows\antivirus-platinum.exe
| MD5 | cd1800322ccfc425014a8394b01a4b3d |
| SHA1 | 171073975effde1c712dfd86309457fd457aed33 |
| SHA256 | 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0 |
| SHA512 | 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6 |
memory/2880-73-0x0000000000400000-0x0000000000410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
| MD5 | 979b597855746aee2f30ee74f9d7c163 |
| SHA1 | 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f |
| SHA256 | dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11 |
| SHA512 | 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e |
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
| MD5 | c7e9746b1b039b8bd1106bca3038c38f |
| SHA1 | cb93ac887876bafe39c5f9aa64970d5e747fb191 |
| SHA256 | b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4 |
| SHA512 | cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724 |
memory/1748-80-0x00000000002F0000-0x00000000002F8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
| MD5 | ebfbd478a8cfc0fb645b8559973690cb |
| SHA1 | 88ec8dff51b53beed128582bcaf86ea81f684a0f |
| SHA256 | 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59 |
| SHA512 | 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82 |
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
| MD5 | b2eca909a91e1946457a0b36eaf90930 |
| SHA1 | 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa |
| SHA256 | 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c |
| SHA512 | 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf |
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe
| MD5 | 3e20f1b0a3bb4c8608844e47d92d2121 |
| SHA1 | e2f84e46d4e63cbd091feeca686814752519596e |
| SHA256 | a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793 |
| SHA512 | 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b |
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/3044-109-0x00000000002B0000-0x00000000002C0000-memory.dmp
memory/1020-110-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1632-111-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1748-112-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/3044-114-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/3044-116-0x00000000040B0000-0x00000000040F0000-memory.dmp
memory/1284-115-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2944-113-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2016-118-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1708-119-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/524-120-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2780-121-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2508-122-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2064-123-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2052-124-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1992-125-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1952-126-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2068-127-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/600-128-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2684-129-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1988-130-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1748-131-0x00000000047B0000-0x00000000047F0000-memory.dmp
memory/1556-133-0x0000000000400000-0x000000000040D000-memory.dmp
memory/1284-134-0x0000000000730000-0x0000000000770000-memory.dmp
memory/1020-132-0x0000000004820000-0x0000000004860000-memory.dmp
memory/600-137-0x00000000041C0000-0x0000000004200000-memory.dmp
memory/1020-138-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1632-139-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2068-140-0x0000000000760000-0x00000000007A0000-memory.dmp
memory/1748-142-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1708-146-0x00000000046F0000-0x0000000004730000-memory.dmp
memory/1284-147-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/3044-149-0x00000000040B0000-0x00000000040F0000-memory.dmp
memory/2016-150-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2780-151-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1708-152-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/524-153-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2508-154-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2052-148-0x0000000004610000-0x0000000004650000-memory.dmp
memory/1952-157-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/524-162-0x0000000004940000-0x0000000004980000-memory.dmp
memory/2064-161-0x0000000004830000-0x0000000004870000-memory.dmp
memory/2068-163-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2684-165-0x0000000004210000-0x0000000004250000-memory.dmp
memory/2016-164-0x0000000002110000-0x0000000002150000-memory.dmp
memory/2780-160-0x0000000000320000-0x0000000000360000-memory.dmp
memory/2508-159-0x0000000002180000-0x00000000021C0000-memory.dmp
memory/600-158-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2684-166-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1988-167-0x0000000004910000-0x0000000004950000-memory.dmp
memory/1992-156-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/2052-155-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1992-145-0x0000000000300000-0x0000000000340000-memory.dmp
memory/1952-144-0x0000000000700000-0x0000000000740000-memory.dmp
memory/2944-143-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/3044-141-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/1988-168-0x0000000073550000-0x0000000073C3E000-memory.dmp
memory/3044-169-0x00000000040B0000-0x00000000040F0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
| MD5 | 7fad92afda308dca8acfc6ff45c80c24 |
| SHA1 | a7fa35e7f90f772fc943c2e940737a48b654c295 |
| SHA256 | 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f |
| SHA512 | 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea |
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
| MD5 | 2e7303646c46d7b2ad91791c86f1fab1 |
| SHA1 | b54596ea16274188a8b99eb2815aaa6dd74654d3 |
| SHA256 | e17fe8c3eb286aaffec1eb5df7fa648667fbc137bdfcc8c5ed50520ddc5b2c18 |
| SHA512 | 30b73815a4266d0fbf0ffd84cc41b6ca03c8546b75e460fb3a6fde395d2c9b8bc08146f720ce8c287d85151ddabad869da7357b61cacab7fc9fb45023311c550 |
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe
| MD5 | 8edb51ed1d3241c4f026bb0d5de20f89 |
| SHA1 | 9453b850f98062c0b3955a58c295a662be605efb |
| SHA256 | c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47 |
| SHA512 | 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2 |
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe
| MD5 | 05ad3f85b73e5ff86504f8dcc55b5d42 |
| SHA1 | 927d4554328cc6d767a566c3c6cb54c16d58857a |
| SHA256 | 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af |
| SHA512 | 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18 |
memory/2356-205-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe
| MD5 | 6a4853cd0584dc90067e15afb43c4962 |
| SHA1 | ae59bbb123e98dc8379d08887f83d7e52b1b47fc |
| SHA256 | ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec |
| SHA512 | feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996 |
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe
| MD5 | a50c74202e2f4d938babf556b9f54725 |
| SHA1 | 6810db1606cac6ab19edbaa49620ba197ef7bc64 |
| SHA256 | 937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a |
| SHA512 | 28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9 |
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe
| MD5 | 83726a8767faba50ea1b5f31afef5938 |
| SHA1 | 70165dcc633f3390d98ae08c731113b007069737 |
| SHA256 | e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4 |
| SHA512 | e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301 |
\Users\Admin\AppData\Local\Temp\nso6FB5.tmp\LangDLL.dll
| MD5 | de3558ce305e32f742ff25b697407fec |
| SHA1 | d55c50c546001421647f2e91780c324dbb8d6ebb |
| SHA256 | 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a |
| SHA512 | 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac |
\Users\Admin\AppData\Local\Temp\nso6FB5.tmp\GetVersion.dll
| MD5 | dc9562578490df8bc464071f125bfc19 |
| SHA1 | 56301a36ae4e3f92883f89f86b5d04da1e52770d |
| SHA256 | 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f |
| SHA512 | 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321 |
C:\Users\Admin\AppData\Local\Temp\7233.tmp\VirusCan.bat
| MD5 | 55dcde25c122c782757989a3c275fea2 |
| SHA1 | a669581a58e6aa602cbdaf690e3e365fa4de570f |
| SHA256 | 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916 |
| SHA512 | b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2 |
memory/1884-240-0x0000000000400000-0x0000000000410000-memory.dmp
memory/884-248-0x0000000000400000-0x000000000043E000-memory.dmp