e8419d5bb0db3e945ca90579f079fdf907237defe8017c63e0188b2de518b1d3

Analysis

max time kernel
18s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Terminator3.1.exe
Size

2.0MB
MD5

2bc248da7543ff3e8a7aeb2353d4daa7
SHA1

2ab295c16a8b762a26b37dc71c08dacda6bf8bbe
SHA256

e8419d5bb0db3e945ca90579f079fdf907237defe8017c63e0188b2de518b1d3
SHA512

3bb822b668506fac45d803b7ebe2b5d5bd2ca9d851746ceedb02619fc9c1f54648a720a7d9fde6e29bb7ac017fefb721c55b2de64f5eeada3e6f2d11f3fefbdf
SSDEEP

24576:qD/RbUThN+XbXgZruqHrawhaUTFR7mDdsrsG5UHulCXR+xaTSfoY4f0y3QzpCy8v:qjRbU2XlqHBNpEdsC5TSf

Score

9^/10

bootkit persistence ransomware spyware stealer upx

Malware Config

Signatures

Renames multiple (234) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ExtraDll.dll	acprotect

Drops startup file 6 IoCs

Processes:

Terminator3.1.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Application.lnk	Terminator3.1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.Terminated	Terminator3.1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.Terminated.Terminated	Terminator3.1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.Terminated.Terminated.Terminated	Terminator3.1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.Terminated.Terminated.Terminated.Terminated	Terminator3.1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Application.lnk	Terminator3.1.exe

Loads dropped DLL 1 IoCs

Processes:

Terminator3.1.exe

pid process

2912 Terminator3.1.exe

pid	process
2912	Terminator3.1.exe

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

cmd.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Compatibility	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ExtraDll.dll	upx
behavioral1/memory/2912-4-0x0000000074E90000-0x0000000074ECC000-memory.dmp	upx
behavioral1/memory/2912-322-0x0000000074E90000-0x0000000074ECC000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Terminator3.1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Application = "C:\\windows\\winnt32.exe"	Terminator3.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Application = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terminator3.1.exe"	Terminator3.1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

cmd.execmd.execmd.exeTerminator3.1.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	cmd.exe
File opened for modification	\??\PhysicalDrive0	cmd.exe
File opened for modification	\??\PhysicalDrive0	cmd.exe
File opened for modification	\??\physicaldrive0	Terminator3.1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Terminator3.1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0.bmp"	Terminator3.1.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Terminator3.1.exe

description	pid	process	target process
PID 2912 set thread context of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 set thread context of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 set thread context of 1684	2912	Terminator3.1.exe	cmd.exe

Drops file in Windows directory 2 IoCs

Processes:

Terminator3.1.exe

description ioc process

File created C:\windows\winnt32.exe Terminator3.1.exe
File opened for modification C:\windows\winnt32.exe Terminator3.1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\windows\winnt32.exe	Terminator3.1.exe
File opened for modification	C:\windows\winnt32.exe	Terminator3.1.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

Terminator3.1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\WallpaperStyle = "2"	Terminator3.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\TileWallpaper = "2"	Terminator3.1.exe

Modifies registry class 64 IoCs

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\Programmable	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1DE5FDEC-B2CD-3BBA-AA0D-D038A4CEC6AC}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Slide.8\Shell\OpenAsReadOnly	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.ACE.OLEDB.12.0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000208A7-0000-0000-C000-000000000046}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{305104B9-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4F55F4-8F87-4D47-80BB-5808164BB3F8}\ProgID	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5477469E-83B1-11D2-8B49-00A0C9B7C9C4}\2.0\0\win32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicScriptAutoImpPerformance	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56048119-A1A8-46BB-9FD2-3336B9CB7826}\ProxyStubClsid	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{305106FD-98B5-11CF-BB82-00AA00BDCE0B}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00024435-0000-0000-C000-000000000046}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F83A-98B5-11CF-BB82-00AA00BDCE0B}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{051C8C9A-DE37-4545-AE34-0A6A4AE8C014}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B3E5A7FF-AFC6-3F2B-8FFF-300C7C567693}\4.0.0.0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E000160D-DD29-4F11-B56F-4F2FDF75BC8B}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C170F-0000-0000-C000-000000000046}\ProxyStubClsid	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4072AE37-3739-43C9-AC88-CA2EA79ED32B}\NumMethods	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1682EAF3-9A6F-42DA-8D68-CD691956B996}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000209CE-0000-0000-C000-000000000046}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2AB0E063-AFC3-11D2-A5E5-00105A0D058F}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{BA5ED019-F669-3C35-93AC-3ABF776B62B3}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F6F94D22-78C2-11D2-8FFE-00C04FA38314}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{84A6368C-7A7C-440D-8D51-D95497338AAD}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5AF314CF-8849-4A79-A3FC-8DE6625D9E72}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4F9F9D39-3EBE-422B-BD08-89A99BF9826D}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{96E0DEE8-C1CA-38A5-A3C9-52DA9B5440EF}\2.0.0.0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{94DFA723-76CB-11D3-8825-0080C7868F6F}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7550D0CB-769F-4E53-AAAA-64824B4CADAC}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000CD706-0000-0000-C000-000000000046}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE7A93CF-9D9F-441E-9A83-9DF4ACD2E42E}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A87E00E9-3AC3-4B53-ABE3-7379653D0E82}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A621B292-B02C-4400-90FE-457E218F89C6}\ProxyStubClsid	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\MiscStatus	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Windows.XPSActiveDocument\CurVer	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{68DB6E95-F774-3AE3-B1DE-B0CC80F6E174}\2.0.0.0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSpiderSolitaireSaveFile\Shell	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31411192-A502-11D2-BBCA-00C04F8EC294}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0318-0000-0000-C000-000000000046}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000214EE-0000-0000-C000-000000000046}\NumMethods	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000208AE-0000-0000-C000-000000000046}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v11\Dependents	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87762ECE-86A3-4ED8-B0DD-22999E4C5171}\1.0\HELPDIR	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9072AC7B-1D2B-453F-80EB-B8CE771BB30A}\ProxyStubClsid	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C}\1.0\HELPDIR	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EC59C852-0460-3690-8726-D1F202C6A523}\14.0.0.0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4AA7DD1B-FD29-47AB-BB69-CF3A6C275A85}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{85CE0ADF-2D08-4FE7-A171-B3E6134E592D}\ProxyStubClsid	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{314111F3-A502-11D2-BBCA-00C04F8EC294}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C514A18E-862A-45d3-8A5E-62CF54D912B6}	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0006F067-0000-0000-C000-000000000046}\Typelib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocMIME.3GP	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset\korean	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{947AAB5F-0A5C-4C13-B4D6-4BF7836FC9F8}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0006F04A-0000-0000-C000-000000000046}\InprocServer32\14.0.0.0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A7F337A3-D20B-45CB-9ED7-87D094CA5045}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB23654A-418B-4CD3-97B2-5010CFE6AC86}\TypeLib	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA19E87-40FD-4B02-AD7C-CB625991DE05}\ProxyStubClsid	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0334-0000-0000-C000-000000000046}\ProxyStubClsid32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30850EDF-6544-49D8-B2F7-1219F552F586}\1.0\0	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\ProxyStubClsid32	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Terminator3.1.exe

pid process

2912 Terminator3.1.exe
2912 Terminator3.1.exe

pid	process
2912	Terminator3.1.exe
2912	Terminator3.1.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

Terminator3.1.exe

description	pid	process	target process
PID 2912 wrote to memory of 2740	2912	Terminator3.1.exe	notepad.exe
PID 2912 wrote to memory of 2740	2912	Terminator3.1.exe	notepad.exe
PID 2912 wrote to memory of 2740	2912	Terminator3.1.exe	notepad.exe
PID 2912 wrote to memory of 2740	2912	Terminator3.1.exe	notepad.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 2392	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1916	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 376	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 376	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 376	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 376	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe
PID 2912 wrote to memory of 1684	2912	Terminator3.1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Terminator3.1.exe
"C:\Users\Admin\AppData\Local\Temp\Terminator3.1.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\notepad.exe
notepad C:\Users\Admin\Desktop\GOOD NEWS.txt
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
- Modifies system executable filetype association
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1684

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2336

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk.Terminated.Terminated.Terminated
Filesize
1KB

MD5
5c1d6c509273916156f53164100413a5

SHA1
b3e1ae148d992c66a0af1a12d6b38bdedac44a54

SHA256
e3ad9e6efabb8eb6bcb48385af893d1e4784a9aa7ac01b27f02728711e5746da

SHA512
6efe33c14aa6490bf0625af86b647895503550c1642786d0f6c305f1e4529f281c6620a517bb64213f12a9f6d644a0a4cbbf623f2db66855d6f4894a27efdf95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk.Terminated.Terminated.Terminated
Filesize
288B

MD5
0b926f9652ada0f19f4c8aa499e2ed27

SHA1
3272e785b27497985b537126851a2ff9dccdd913

SHA256
fc703c2c6605ca310575d0e2c03f99af0038aad6ce7f5b65075c2d10f72cc120

SHA512
73e4c8700cc9ee593a351cc23c05f63cf268113de72290ec6b7e9873f6fd34c96c9cfae81fd1cd8daf18bdd055df5dc86399d6cb179483d569eb41591d945941

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.Terminated
Filesize
48KB

MD5
1240dc71bcc0f3ead172844c8211fe72

SHA1
f777c8311f4503d8696b35790103c80b6661143d

SHA256
081fa8428d3c2a8f552278754f9573083e0ed6f29a3aad10dcab861b32d8f929

SHA512
154a0898d8f90d665d12ef0eeaa69b42f7db84c952614430754d5190079bc4a32b301c4273efe46eab7fe42194ecfdd76c7f56254a31d68a3a73f43fc52b4f15

Download Submit
C:\Users\Admin\Desktop\GOOD NEWS.txt
Filesize
12KB

MD5
9591a9f12d3e40cdad5a6393f90a4fe0

SHA1
812554e61b48153c5f516f716ff007be937aa92f

SHA256
8758fcc47dbd9c66513b4d22f10cc41aa84c9f9599a883eebf52d221bef57c12

SHA512
1517488d21e8c954327a6a5f5c81ec57f369516176721f1c6ebb98ae961357eaae3441f12a4e6ecc930aa05f709dba02e5765c7726d260cd51e10c03b816b6e0

Download Submit
\Users\Admin\AppData\Local\Temp\ExtraDll.dll
Filesize
97KB

MD5
c35425ad1f0c32225d307310deccc335

SHA1
b2e347b244e40ffa113dffaffd1895777e3ac30a

SHA256
48773d597155dc39dd172c26867972da89dd61fcee0d138433eda26a2d8633b7

SHA512
47b6a7447fcc4f9f21018f608fcbdb5650f16cbd869cae5d4ed5d9b88ca1e944de1cac10e9a252aa7b210f1a31456c0ed91728b8a7e24def99d7e3f9683e2bae

Download Submit
memory/2392-266-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-270-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-267-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2392-260-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-254-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-252-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-250-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-263-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2392-257-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2912-4-0x0000000074E90000-0x0000000074ECC000-memory.dmp

Filesize
240KB

Download
memory/2912-322-0x0000000074E90000-0x0000000074ECC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads