Malware Analysis Report

2024-08-06 16:07

Sample ID 240508-bc4gkscf59
Target 225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.zip
SHA256 d76ecb65d7444d3a7bef1775797175d6ee1df6274668a8a82af18517af89b2ba
Tags
chaos defense_evasion evasion execution impact persistence ransomware spyware stealer pyinstaller
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d76ecb65d7444d3a7bef1775797175d6ee1df6274668a8a82af18517af89b2ba

Threat Level: Known bad

The file 225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.zip was found to be: Known bad.

Malicious Activity Summary

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer pyinstaller

Chaos Ransomware

Chaos

Deletes shadow copies

Renames multiple (178) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes backup catalog

Disables Task Manager via registry modification

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Drops startup file

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

Modifies registry class

Checks SCSI registry key(s)

Interacts with shadow copies

Suspicious behavior: GetForegroundWindowSpam

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Opens file in notepad (likely ransom note)

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Windows Management Instrumentation
T1047
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-08 01:00

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-08 01:00

Reported

2024-05-08 01:10

Platform

win10v2004-20240419-en

Max time kernel

138s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (178) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\unlock.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1496 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe
PID 1496 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe
PID 3372 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Windows\system32\cmd.exe
PID 3372 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Windows\system32\cmd.exe
PID 4728 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe
PID 4728 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe
PID 4728 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe
PID 3568 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe
PID 3568 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe
PID 3744 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 3744 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 3976 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3976 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 4460 wrote to memory of 3928 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4460 wrote to memory of 3928 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4460 wrote to memory of 4420 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4460 wrote to memory of 4420 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3976 wrote to memory of 700 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3976 wrote to memory of 700 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 700 wrote to memory of 3344 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 700 wrote to memory of 3344 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 700 wrote to memory of 3416 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 700 wrote to memory of 3416 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3976 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3976 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\System32\cmd.exe
PID 3184 wrote to memory of 1924 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3184 wrote to memory of 1924 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3976 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 3976 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe

"C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe"

C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe

"C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe"

C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe

C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\unlock.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 codeload.github.com udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 216.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 49.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI14962\python311.dll

MD5 1fe47c83669491bf38a949253d7d960f
SHA1 de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
SHA512 05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

C:\Users\Admin\AppData\Local\Temp\_MEI14962\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_ssl.pyd

MD5 0a7eb5d67b14b983a38f82909472f380
SHA1 596f94c4659a055d8c629bc21a719ce441d8b924
SHA256 3bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380
SHA512 3b78fd4c03ee1b670e46822a7646e668fbaf1ef0f2d4cd53ccfcc4abc2399fcc74822f94e60af13b3cdcb522783c008096b0b265dc9588000b7a46c0ed5973e1

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_bz2.pyd

MD5 a8a37ba5e81d967433809bf14d34e81d
SHA1 e4d9265449950b5c5a665e8163f7dda2badd5c41
SHA256 50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b
SHA512 b50f4334acb54a6fba776fc77ca07de4940810da4378468b3ca6f35d69c45121ff17e1f9c236752686d2e269bd0b7bce31d16506d3896b9328671049857ed979

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_lzma.pyd

MD5 bc07d7ac5fdc92db1e23395fde3420f2
SHA1 e89479381beeba40992d8eb306850977d3b95806
SHA256 ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b
SHA512 b6105333bb15e65afea3cf976b3c2a8a4c0ebb09ce9a7898a94c41669e666ccfa7dc14106992502abf62f1deb057e926e1fd3368f2a2817bbf6845eada80803d

C:\Users\Admin\AppData\Local\Temp\_MEI14962\libssl-1_1.dll

MD5 86f2d9cc8cc54bbb005b15cabf715e5d
SHA1 396833cba6802cb83367f6313c6e3c67521c51ad
SHA256 d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771
SHA512 0013d487173b42e669a13752dc8a85b838c93524f976864d16ec0d9d7070d981d129577eda497d4fcf66fc6087366bd320cff92ead92ab79cfcaa946489ac6cb

C:\Users\Admin\AppData\Local\Temp\_MEI14962\unicodedata.pyd

MD5 2ab7e66dff1893fea6f124971221a2a9
SHA1 3be5864bc4176c552282f9da5fbd70cc1593eb02
SHA256 a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f
SHA512 985480fffcc7e1a25c0070f44492744c3820334a35b9a72b9147898395ab60c7a73ea8bbc761de5cc3b6f8799d07a96c2880a7b56953249230b05dd59a1390ad

C:\Users\Admin\AppData\Local\Temp\_MEI14962\certifi\cacert.pem

MD5 d3e74c9d33719c8ab162baa4ae743b27
SHA1 ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b
SHA256 7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92
SHA512 e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c

C:\Users\Admin\AppData\Local\Temp\_MEI14962\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

MD5 9ea8098d31adb0f9d928759bdca39819
SHA1 e309c85c1c8e6ce049eea1f39bee654b9f98d7c5
SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
SHA512 86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

C:\Users\Admin\AppData\Local\Temp\_MEI14962\charset_normalizer\md.cp311-win_amd64.pyd

MD5 723ec2e1404ae1047c3ef860b9840c29
SHA1 8fc869b92863fb6d2758019dd01edbef2a9a100a
SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
SHA512 2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_queue.pyd

MD5 e0cc8c12f0b289ea87c436403bc357c1
SHA1 e342a4a600ef9358b3072041e66f66096fae4da4
SHA256 9517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03
SHA512 4d93f23db10e8640cd33e860241e7ea6a533daf64c36c4184844e6cca7b9f4bd41db007164a549e30f5aa9f983345318ff02d72815d51271f38c2e8750df4d77

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_hashlib.pyd

MD5 1c88b53c50b5f2bb687b554a2fc7685d
SHA1 bfe6fdb8377498bbefcaad1e6b8805473a4ccbf3
SHA256 19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778
SHA512 a312b11c85aaa325ab801c728397d5c7049b55fa00f24d30f32bf5cc0ad160678b40f354d9d5ec34384634950b5d6eda601e21934c929b4bc7f6ef50f16e3f59

C:\Users\Admin\AppData\Local\Temp\_MEI14962\libcrypto-1_1.dll

MD5 80b72c24c74d59ae32ba2b0ea5e7dad2
SHA1 75f892e361619e51578b312605201571bfb67ff8
SHA256 eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d
SHA512 08014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a

C:\Users\Admin\AppData\Local\Temp\_MEI14962\select.pyd

MD5 4ac28414a1d101e94198ae0ac3bd1eb8
SHA1 718fbf58ab92a2be2efdb84d26e4d37eb50ef825
SHA256 b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5
SHA512 2ac15e6a178c69115065be9d52c60f8ad63c2a8749af0b43634fc56c20220afb9d2e71ebed76305d7b0dcf86895ed5cdfb7d744c3be49122286b63b5ebce20c2

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_socket.pyd

MD5 290dbf92268aebde8b9507b157bef602
SHA1 bea7221d7abbbc48840b46a19049217b27d3d13a
SHA256 e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe
SHA512 9ae02b75e722a736b2d76cec9c456d20f341327f55245fa6c5f78200be47cc5885cb73dc3e42e302c6f251922ba7b997c6d032b12a4a988f39bc03719f21d1a5

C:\Users\Admin\AppData\Local\Temp\_MEI14962\_decimal.pyd

MD5 5e8aa9cd4742a51acc5b2155770241d5
SHA1 af030327ea6702a081de422168d812263f581470
SHA256 59fee7a8d0a85ed98bbf5dfb7a0ad64b60cbe88427efd98b3c9faad3e4421a87
SHA512 e751621902897db7274b481386a811d2aabb63aa67759107c2f61bf29afc5437e7f5892158c83810dd5b5b498d160e308e6ed6453102d9bb58fc8f7dabf58697

C:\Users\Admin\AppData\Local\Temp\_MEI14962\base_library.zip

MD5 2efeab81308c47666dfffc980b9fe559
SHA1 8fbb7bbdb97e888220df45cc5732595961dbe067
SHA256 a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad
SHA512 39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

C:\Users\Admin\AppData\Local\Temp\tmpal3y2_75\Xam71-main\A.exe

MD5 7f4deba5ab9afd55e25535f3ada87c37
SHA1 08e71dff463540be246bc999289df77bc39e8004
SHA256 7073f82a401f5ccfffad8a3dc5e390bf43075e24d80fe8d38360f54ac10dfc67
SHA512 a1889c68313badba559bb4774444c77f6d0918733f338859e0d5a5f7db43a7c9ee1f2c827cc92fa5c0d2fd53525b46b5cc6e7344d9a698446832763db5a1417d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.exe

MD5 a87448407f580aca26856668b1421ca3
SHA1 ea453ed748d7b59f27e6ccbe7a3c47982b8d831a
SHA256 018699d7f48805c5eec9236d386c71883a3bb78cc29eec6a354784547672c267
SHA512 9e0e24f0aef6aaf7a13cbb646084484f7eaf80f83eb2390e3764cd28982ec5d4148291e14c617f6fe38fe2eb5f8dbae3a45770a7d0919860d09c582e02743233

memory/3744-72-0x0000000000D40000-0x0000000000D4E000-memory.dmp

C:\Users\Admin\AppData\Local\unlock.txt

MD5 19c0d8b1825404eeeb36aba59ad88a6b
SHA1 5b9e2eb1f8ceaa14af46733b64d568aeacd96380
SHA256 d1cc4594d393c62ebe735dde25d60b49501a99447b7bc2329f6d94c9a942c56c
SHA512 9700451a730dc67bc1e2284f9e082e467b5a2bcb9f54d4446368b02edf8809de1a8ce3d43a14fbcdb91adbdca23bfaf64f7b0053552844068ec96f5ee8f0965d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

C:\Users\Public\Desktop\VLC media player.lnk

MD5 d1457b72c3fb323a2671125aef3eab5d
SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-08 01:00

Reported

2024-05-08 01:10

Platform

win7-20240221-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2088 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe
PID 2088 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe
PID 2088 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe

Processes

C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe

"C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe"

C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe

"C:\Users\Admin\AppData\Local\Temp\225e299bca1514858a1c31e85c05a2e7375f9f8d7095f5775dffe4d048e78892.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI20882\python311.dll

MD5 1fe47c83669491bf38a949253d7d960f
SHA1 de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
SHA512 05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4