Malware Analysis Report

2025-03-14 22:20

Sample ID 240407-27qgbahe86
Target 8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f
SHA256 8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f
Tags
persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f

Threat Level: Known bad

The file 8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f was found to be: Known bad.

Malicious Activity Summary

persistence

Detects executables packed with ASPack

Detects executables packed with ASPack

Loads dropped DLL

Executes dropped EXE

Modifies system executable filetype association

Enumerates connected drives

Adds Run key to start application

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:13

Signatures

Detects executables packed with ASPack

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:13

Reported

2024-04-07 23:16

Platform

win7-20240221-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe"

Signatures

Detects executables packed with ASPack

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\$Recycle.Bin\TEY.EXE N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\HEYYXX.EXE \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HEYYXX.EXE = "C:\\Users\\HEYYXX.EXE" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\H: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\I: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\P: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\G: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\S: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\U: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\V: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\E: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\K: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\L: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\M: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\O: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\R: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\T: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\J: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\N: C:\$Recycle.Bin\TEY.EXE N/A
File opened (read-only) \??\Q: C:\$Recycle.Bin\TEY.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\KESZT.EXE C:\$Recycle.Bin\TEY.EXE N/A
File created C:\Program Files (x86)\WIBSW.EXE C:\$Recycle.Bin\TEY.EXE N/A
File created C:\Program Files (x86)\OYGBX.EXE C:\$Recycle.Bin\TEY.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WKJLGSD.EXE C:\$Recycle.Bin\TEY.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Users\\HEYYXX.EXE \"%1\"" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Users\\HEYYXX.EXE \"%1\"" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file C:\$Recycle.Bin\TEY.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\HEYYXX.EXE \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\PerfLogs\\ASUO.EXE %1" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Users\\HEYYXX.EXE %1" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile C:\$Recycle.Bin\TEY.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell C:\$Recycle.Bin\TEY.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe

"C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe"

C:\$Recycle.Bin\TEY.EXE

C:\$Recycle.Bin\TEY.EXE

Network

N/A

Files

memory/1048-0-0x0000000000220000-0x0000000000221000-memory.dmp

C:\Users\HEYYXX.EXE

MD5 e51d14fc99c07a4377a6a841b06de296
SHA1 79625116be7735a734b8885a0d71782fb0a3af6d
SHA256 7ed8825e615e10da7a73f84478d1d914af6a4ffe0754c839ba5230b6f1e07b9e
SHA512 9dbaff5c74f5f0e4367415c1f4cc412e8c0979ee44de5d7f8cefa139377d5405d2c4cdafe5ba074114301c3c025bb1eb963635e956dd58a02b67fbfd3a86be9b

C:\filedebug

MD5 f0085afcb64a71f5b04c37f87b5259b7
SHA1 3d6ae628935231143a1b7806c2c69a0c8b0b8e8a
SHA256 4d9c8497e08691d335ee440006094e0cfcbb788bcdee05626b7b0d2c3993c6f3
SHA512 81d96933ce034bd33c4a98236a088242e7a32f4db1669f9b11e670fcf981285435432373a38a51ab38ec14c6245869d40e6efb2d275b584aa6631f11f5e6fadc

C:\$Recycle.Bin\TEY.EXE

MD5 bbf9e18933efab68d10d561e36367fee
SHA1 18ce11988ee1e26f94fcaa24143f625c0dbd657c
SHA256 44ea44ba7eef516720a9cdcbac4ffec3f0be9693747bd33900a8a6a3c565d0d2
SHA512 aa53f26958ee90777505e48d3992823fcadb15c731864bdced01871474f3d89495f56284496bbe3b3bd1a02a6d5d37cb43562cfd18705c47d749b3d6d65b0ad9

memory/2544-26-0x0000000000220000-0x0000000000221000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:13

Reported

2024-04-07 23:16

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe"

Signatures

Detects executables packed with ASPack

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\ULXZCJL.EXE N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\PerfLogs\\GOYZ.EXE \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\ULXZCJL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NACJEMZ.EXE = "C:\\Windows\\NACJEMZ.EXE" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\PerfLogs\\GOYZ.EXE \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\PerfLogs\\GOYZ.EXE %1" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\PerfLogs\\GOYZ.EXE \"%1\"" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\PerfLogs\\GOYZ.EXE \"%1\"" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\ULXZCJL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\PerfLogs\\GOYZ.EXE %1" C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\ULXZCJL.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe

"C:\Users\Admin\AppData\Local\Temp\8d00635fc55eddbc9ac575ef147b532b0d4bed55583bdca3dcc33df909eaa44f.exe"

C:\Windows\ULXZCJL.EXE

C:\Windows\ULXZCJL.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4880-4-0x00000000021F0000-0x00000000021F1000-memory.dmp

C:\PerfLogs\GOYZ.EXE

MD5 165280c6246c57ea0cf55bf85acdd5ef
SHA1 080cc4510afea9f1706c3d7a18d490edff38c421
SHA256 4782fc7f44d56ed93c05d0c1b6c7399804afaf0024df4300eb2026f33e4af1a2
SHA512 d7052815824cbb6749750242875419f71de5ec986987e54e80d3ea8cf9d24b18c26e28755c1b12425f17233fc48536ef9b440913dfbbd23bca41cba67299d12d

C:\Windows\ULXZCJL.EXE

MD5 fc6c8c1309bf55141d60c52043f86d10
SHA1 07e228551b0aa4b4fd90db071e950f6e0853c7cf
SHA256 2a89f40fc69d3cb0e5b3f67d406ecf527552cbfc7ef7c05aa1a750cc2caf59c9
SHA512 cda45aa0c186ae0d06a175bd92b7d66a8d80028c11895a53ec5b06f30f7d6e6d2854d62559ed7aa7dab4dc60706d1d9de3d4a9d718ad76fcdd19da6643ddb435

memory/2252-22-0x0000000000610000-0x0000000000611000-memory.dmp

memory/2252-23-0x0000000000610000-0x0000000000611000-memory.dmp