Malware Analysis Report

2025-08-05 19:16

Sample ID 240526-d5kahsdd6t
Target d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e
SHA256 d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e
Tags
upx evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e

Threat Level: Known bad

The file d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e was found to be: Known bad.

Malicious Activity Summary

upx evasion persistence

UPX dump on OEP (original entry point)

Modifies firewall policy service

UPX dump on OEP (original entry point)

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 03:35

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 03:35

Reported

2024-05-26 03:38

Platform

win7-20231129-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2640 set thread context of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 set thread context of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2392 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2392 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2392 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2392 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3024 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3024 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 1360 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1360 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1360 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1360 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2436 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2436 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2436 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2436 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe

"C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RvMLq.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f

C:\Users\Admin\AppData\Roaming\Firefox.exe

"C:\Users\Admin\AppData\Roaming\Firefox.exe"

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/2392-0-0x0000000000400000-0x00000000005D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RvMLq.bat

MD5 962bc493b87f298696ad6e3eed7c7937
SHA1 985cc0c7e37e2465c4349abd528e120663ebd205
SHA256 c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA512 9dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173

C:\Users\Admin\AppData\Roaming\Firefox.exe

MD5 f1bfc1bff60dc20d52f39bf4f206ed96
SHA1 6c77bd28d5cdf936d8d437b244e9f34867d892e6
SHA256 1aabdcf89d0e3848c9cf5ecdab3ee5429d5637d57db5228928c58056c62b2984
SHA512 f08a0d1843bf10b26480d4d66ec5e50ee7e5b88c91cb692c331d6809d7519397eae3844d5762847e23840be26a597d3d87b586662a889d38f22907e0537f7e26

memory/2640-44-0x0000000000400000-0x00000000005D9000-memory.dmp

memory/2392-46-0x0000000000400000-0x00000000005D9000-memory.dmp

memory/2392-43-0x00000000031D0000-0x00000000033A9000-memory.dmp

memory/2640-51-0x0000000002910000-0x0000000002AE9000-memory.dmp

memory/3024-52-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3024-55-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2640-59-0x0000000002910000-0x0000000002AE9000-memory.dmp

memory/3024-58-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2536-70-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2536-68-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2640-74-0x0000000000400000-0x00000000005D9000-memory.dmp

memory/2536-65-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3024-75-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2536-76-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3024-77-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3024-79-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3024-83-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3024-104-0x0000000000400000-0x000000000045D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 03:35

Reported

2024-05-26 03:38

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4280 set thread context of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 set thread context of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1148 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Windows\SysWOW64\cmd.exe
PID 4632 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4632 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4632 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1148 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 1148 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 1148 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4280 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3136 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2480 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2480 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3160 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4884 wrote to memory of 3300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3160 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3160 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4884 wrote to memory of 3300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4884 wrote to memory of 3300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2664 wrote to memory of 2388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2664 wrote to memory of 2388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2664 wrote to memory of 2388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe

"C:\Users\Admin\AppData\Local\Temp\d7b4797229f6e799cf8d67db038fadf347c6280dfd7e5b97ea7f22f165f56e6e.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qZEpo.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f

C:\Users\Admin\AppData\Roaming\Firefox.exe

"C:\Users\Admin\AppData\Roaming\Firefox.exe"

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

memory/1148-0-0x0000000000400000-0x00000000005D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qZEpo.bat

MD5 962bc493b87f298696ad6e3eed7c7937
SHA1 985cc0c7e37e2465c4349abd528e120663ebd205
SHA256 c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA512 9dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173

C:\Users\Admin\AppData\Roaming\Firefox.txt

MD5 20cd867ad1dbf76973dfb9da7feb4563
SHA1 6ee4b134172c9c2739cfb5c95e688f3a7c6e88a6
SHA256 3f4c4e38b02d584fd514821a6381bc0827b7d2a67e063c26e5aed0ce7c3ad294
SHA512 ec055cb406906cb1bb2229af4b15ea4b93074494848be92f7d271530a1001fb941400fcc7aa409ddef023f5bce5b3c5072e0d670cfa134d9c8f28ad74116505a

memory/1148-28-0x0000000000400000-0x00000000005D9000-memory.dmp

memory/3136-31-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3136-34-0x0000000000400000-0x000000000045D000-memory.dmp

memory/680-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/680-39-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3136-36-0x0000000000400000-0x000000000045D000-memory.dmp

memory/680-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4280-49-0x0000000000400000-0x00000000005D9000-memory.dmp

memory/3136-52-0x0000000000400000-0x000000000045D000-memory.dmp

memory/680-53-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3136-54-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3136-56-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3136-60-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3136-76-0x0000000000400000-0x000000000045D000-memory.dmp