Malware Analysis Report

2025-03-14 23:12

Sample ID 240407-abv85seg9w
Target a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74
SHA256 a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74
Tags
evasion persistence ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74

Threat Level: Likely malicious

The file a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74 was found to be: Likely malicious.

Malicious Activity Summary

evasion persistence ransomware

Modifies boot configuration data using bcdedit

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 00:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 00:02

Reported

2024-04-07 00:07

Platform

win7-20240221-en

Max time kernel

210s

Max time network

243s

Command Line

"taskhost.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\f793b7a.sys C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xiafet = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Measom\\xiafet.exe" C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2528 set thread context of 2960 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\cmd.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2472 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 2472 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 2472 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 2472 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 1056 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 1056 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 1056 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 1056 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 2528 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe
PID 2528 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe
PID 2528 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe
PID 2528 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe
PID 1072 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\bcdedit.exe
PID 1072 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\taskhost.exe
PID 1072 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\taskhost.exe
PID 1072 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\taskhost.exe
PID 1072 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\taskhost.exe
PID 1072 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\taskhost.exe
PID 1072 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\Dwm.exe
PID 1072 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\Dwm.exe
PID 1072 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\Dwm.exe
PID 1072 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\Dwm.exe
PID 1072 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\system32\Dwm.exe
PID 1072 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\Explorer.EXE
PID 1072 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe

"C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe"

C:\Users\Admin\AppData\Local\Temp\lcm.exe

"C:\Users\Admin\AppData\Local\Temp\lcm.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\lsias.exe

"C:\Users\Admin\AppData\Local\Temp\lsias.exe"

C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe

"C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe"

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\system32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WQADD6F.bat"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "844197778-5421874441554756392107014615618454053763437781111536675309-344092748"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 116

Network

Country Destination Domain Proto
US 8.8.8.8:53 photovolt.ro udp
RO 89.37.121.88:80 photovolt.ro tcp
CA 50.100.208.136:8656 udp

Files

memory/2472-0-0x0000000000400000-0x0000000000407000-memory.dmp

\Users\Admin\AppData\Local\Temp\lcm.exe

MD5 7dbba94859c6d13b02aa6010301d942e
SHA1 95719bc59b38ea41e2944899de0171a7a064c52e
SHA256 8a4c97df18716d25c508608a6baaf8e940dded4f68cb4924943bc94375f4e327
SHA512 08151b054efb79826d470abc44f65923e1b42a93490f9428f5f767439d5fe0dca604a4786524a511ca8ea89c8a8286847cc77eed579a345c8e29accab7758a12

memory/1056-11-0x0000000000400000-0x0000000000407000-memory.dmp

\Users\Admin\AppData\Local\Temp\lsias.exe

MD5 b765fa6dafe847a21badd35b2db70ce0
SHA1 8de082342547052dbe43bf9d9df0ec5fc4586eb9
SHA256 b943dea63930db983b6d4524dbecf76bc94ece24bc68ee69a658c3e05164ffb9
SHA512 4ccdc9bad6e957f5df3f7ccb3cd11085b44fa234334dacbf042ec942ed67b244178681426f85d38d7ca4c5583d5b546a5c43ba6d6c098d5f63522ed06c99c674

memory/2528-19-0x0000000000400000-0x0000000000499000-memory.dmp

memory/2528-20-0x0000000000310000-0x0000000000311000-memory.dmp

memory/2528-21-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2528-26-0x0000000000400000-0x000000000046D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe

MD5 bea750cba9f5641ddb32ae44022a156c
SHA1 89f94f035cf11ab407bb3852c1b2d5a08de97554
SHA256 08552f6f3fd2bc67826e7b702a7d02e6e0fbef8fd474f1e436034e8f70aa2a1c
SHA512 588230efb8f0fff018595d957e118db8310a3a1ff4dc365723063c62e33fb197c40cb15f2e22aa5bd9004ec7aa1ae06ce1bbd26ef702a22859608c8b0394c37e

memory/1072-33-0x0000000000400000-0x0000000000499000-memory.dmp

memory/2528-39-0x0000000000400000-0x0000000000499000-memory.dmp

memory/1072-40-0x0000000000400000-0x0000000000499000-memory.dmp

memory/1072-42-0x00000000002A0000-0x00000000002A6000-memory.dmp

memory/1248-43-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

memory/1248-44-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

memory/1248-46-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

memory/1248-48-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

memory/1248-50-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

memory/1320-53-0x0000000001C50000-0x0000000001CBD000-memory.dmp

memory/1320-54-0x0000000001C50000-0x0000000001CBD000-memory.dmp

memory/1320-55-0x0000000001C50000-0x0000000001CBD000-memory.dmp

memory/1320-56-0x0000000001C50000-0x0000000001CBD000-memory.dmp

memory/1380-58-0x00000000026E0000-0x000000000274D000-memory.dmp

memory/1380-60-0x00000000026E0000-0x000000000274D000-memory.dmp

memory/1380-59-0x00000000026E0000-0x000000000274D000-memory.dmp

memory/1380-61-0x00000000026E0000-0x000000000274D000-memory.dmp

memory/1416-64-0x0000000002460000-0x00000000024CD000-memory.dmp

memory/1416-66-0x0000000002460000-0x00000000024CD000-memory.dmp

memory/1416-68-0x0000000002460000-0x00000000024CD000-memory.dmp

memory/1416-70-0x0000000002460000-0x00000000024CD000-memory.dmp

memory/2528-73-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/2528-75-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/2528-74-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/2528-76-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/2528-77-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/2528-78-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/2528-80-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/2528-79-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/2528-81-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/2528-82-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/2528-83-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/2528-85-0x0000000077700000-0x0000000077701000-memory.dmp

memory/2528-84-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/2528-86-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/1072-87-0x00000000002A0000-0x00000000002A6000-memory.dmp

memory/2528-88-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

memory/1072-91-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1072-93-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2960-99-0x0000000000240000-0x00000000002AD000-memory.dmp

memory/2528-109-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2456-130-0x0000000000350000-0x00000000003BD000-memory.dmp

memory/2456-131-0x0000000077700000-0x0000000077701000-memory.dmp

memory/2456-134-0x0000000000300000-0x0000000000301000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 00:02

Reported

2024-04-07 00:03

Platform

win10v2004-20240319-en

Max time kernel

48s

Max time network

60s

Command Line

sihost.exe

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\e5787dd.sys C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\lcm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yhih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Botye\\yhih.exe" C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4208 set thread context of 4584 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "56" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3680 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 3680 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 3680 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe C:\Users\Admin\AppData\Local\Temp\lcm.exe
PID 4608 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 4608 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 4608 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\lcm.exe C:\Users\Admin\AppData\Local\Temp\lsias.exe
PID 4208 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe
PID 4208 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe
PID 4208 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\lsias.exe C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe
PID 1636 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1636 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\sihost.exe
PID 1636 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\sihost.exe
PID 1636 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\sihost.exe
PID 1636 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\sihost.exe
PID 1636 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\sihost.exe
PID 1636 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\taskhostw.exe
PID 1636 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\taskhostw.exe
PID 1636 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\taskhostw.exe
PID 1636 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\taskhostw.exe
PID 1636 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\taskhostw.exe
PID 1636 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\Explorer.EXE
PID 1636 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\Explorer.EXE
PID 1636 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\Explorer.EXE
PID 1636 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\Explorer.EXE
PID 1636 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\Explorer.EXE
PID 1636 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\svchost.exe
PID 1636 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\DllHost.exe
PID 1636 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\DllHost.exe
PID 1636 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\DllHost.exe
PID 1636 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\DllHost.exe
PID 1636 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\system32\DllHost.exe
PID 1636 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1636 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1636 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1636 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1636 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.92 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffd0ada5fd8,0x7ffd0ada5fe4,0x7ffd0ada5ff0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3532 --field-trial-handle=3536,i,10914981530159316853,12381340356750224673,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3632 --field-trial-handle=3536,i,10914981530159316853,12381340356750224673,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=3536,i,10914981530159316853,12381340356750224673,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5380 --field-trial-handle=3536,i,10914981530159316853,12381340356750224673,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5524 --field-trial-handle=3536,i,10914981530159316853,12381340356750224673,262144 --variations-seed-version /prefetch:1

C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe

"C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe"

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\lcm.exe

"C:\Users\Admin\AppData\Local\Temp\lcm.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\lsias.exe

"C:\Users\Admin\AppData\Local\Temp\lsias.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe

"C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe"

C:\Windows\System32\wuapihost.exe

C:\Windows\System32\wuapihost.exe -Embedding

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe -set TESTSIGNING ON

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ONU859E.bat"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4208 -ip 4208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 800

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa396f855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 photovolt.ro udp
RO 89.37.121.88:80 photovolt.ro tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 88.121.37.89.in-addr.arpa udp
US 8.8.8.8:53 11.2.37.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
CA 50.100.208.136:8656 udp
US 8.8.8.8:53 136.208.100.50.in-addr.arpa udp
CA 174.95.148.169:6781 udp
US 8.8.8.8:53 169.148.95.174.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
AR 181.28.56.2:4283 udp
US 8.8.8.8:53 2.56.28.181.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 224.162.46.104.in-addr.arpa udp

Files

memory/3680-0-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lcm.exe

MD5 7dbba94859c6d13b02aa6010301d942e
SHA1 95719bc59b38ea41e2944899de0171a7a064c52e
SHA256 8a4c97df18716d25c508608a6baaf8e940dded4f68cb4924943bc94375f4e327
SHA512 08151b054efb79826d470abc44f65923e1b42a93490f9428f5f767439d5fe0dca604a4786524a511ca8ea89c8a8286847cc77eed579a345c8e29accab7758a12

memory/4608-9-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lsias.exe

MD5 b765fa6dafe847a21badd35b2db70ce0
SHA1 8de082342547052dbe43bf9d9df0ec5fc4586eb9
SHA256 b943dea63930db983b6d4524dbecf76bc94ece24bc68ee69a658c3e05164ffb9
SHA512 4ccdc9bad6e957f5df3f7ccb3cd11085b44fa234334dacbf042ec942ed67b244178681426f85d38d7ca4c5583d5b546a5c43ba6d6c098d5f63522ed06c99c674

memory/4208-19-0x0000000000400000-0x0000000000499000-memory.dmp

memory/4208-20-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/4208-21-0x0000000000400000-0x000000000046D000-memory.dmp

memory/4208-25-0x0000000000400000-0x000000000046D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Botye\yhih.exe

MD5 074e3a2c3f9c328270cee84ae129520a
SHA1 08bfab4e28d7398f2bf065a5b8fc262fd68809ff
SHA256 28c1d94a1d8d5bc5818c126e75f777bd71f30a0d2ddaa7289c64e47785383b4a
SHA512 5bf71bf21d86d2459f117a585563c69dbaf97b46c4276bae9fc85f3197937127735d6ce63ebead510c0029c4868971fbf53218424e8031d32c3b84aef8e19271

memory/1636-31-0x0000000000400000-0x0000000000499000-memory.dmp

memory/1636-37-0x0000000000480000-0x0000000000486000-memory.dmp

memory/4208-38-0x00000000021B0000-0x000000000221D000-memory.dmp

memory/4208-39-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4208-40-0x00000000021B0000-0x000000000221D000-memory.dmp

memory/4208-41-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4208-42-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4208-44-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4208-43-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4208-45-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4208-46-0x00000000021B0000-0x000000000221D000-memory.dmp

memory/4208-47-0x00000000021B0000-0x000000000221D000-memory.dmp

memory/1636-50-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1636-52-0x0000000000400000-0x000000000046D000-memory.dmp

memory/4584-51-0x0000000000D00000-0x0000000000D6D000-memory.dmp

memory/4584-57-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-58-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-60-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-59-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-61-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-63-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-62-0x000000006FFF0000-0x0000000070000000-memory.dmp

memory/4584-64-0x0000000000D00000-0x0000000000D6D000-memory.dmp

memory/4584-65-0x0000000000D00000-0x0000000000D6D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ONU859E.bat

MD5 69a8260339b63f8ea6f7854a22f12b06
SHA1 53ee65f3b863fb5c2fe28cf0f108ecc5413ef0a7
SHA256 9d3f8a4a9a39d4c3c4f8c2200aee1d5ef13320dd8f9c8ad5e14df70cc6c2f7e4
SHA512 889ffedb195e2f0adcad1f2e0add8cb8e7388528b60c69969729afe7f6611037d7189455e80d325f05e2389c06f8fac3239e9739ff8445aecd7f33a0f1c0ee17

memory/4208-67-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1636-68-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1636-69-0x0000000000400000-0x0000000000499000-memory.dmp

memory/1636-70-0x0000000000480000-0x0000000000486000-memory.dmp

memory/1636-71-0x0000000000400000-0x000000000046D000-memory.dmp