Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	249.138.73.23.in-addr.arpa	udp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
SE	184.31.15.184:443	www.bing.com	tcp
US	8.8.8.8:53	184.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	30.73.42.20.in-addr.arpa	udp

Files

memory/2096-0-0x0000000000010000-0x000000000002A000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win10v2004-20240426-en

Max time kernel

124s

Max time network

96s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VHD\VHD.bat"

Signatures

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\ConfigFlags	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\System32\vds.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	C:\Windows\explorer.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	C:\Windows\system32\control.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39050000000000	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e0071800000000000000000000006c642f91409ab47be561321b80350960000	C:\Windows\explorer.exe	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\vds.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\vds.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\vds.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\control.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\system32\control.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2968 wrote to memory of 4964	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\diskpart.exe
PID 2968 wrote to memory of 4964	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\diskpart.exe
PID 2968 wrote to memory of 2992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\control.exe
PID 2968 wrote to memory of 2992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\control.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VHD\VHD.bat"

C:\Windows\system32\diskpart.exe

diskpart /s 1.txt

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\control.exe

control /name Microsoft.StorageSpaces

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	56.94.73.104.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	19.229.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20231129-en

Max time kernel

119s

Max time network

120s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\check.bat"

Signatures

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1988 wrote to memory of 2864	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\net.exe
PID 1988 wrote to memory of 2864	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\net.exe
PID 1988 wrote to memory of 2864	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\net.exe
PID 2864 wrote to memory of 2516	N/A	C:\Windows\system32\net.exe	C:\Windows\system32\net1.exe
PID 2864 wrote to memory of 2516	N/A	C:\Windows\system32\net.exe	C:\Windows\system32\net1.exe
PID 2864 wrote to memory of 2516	N/A	C:\Windows\system32\net.exe	C:\Windows\system32\net1.exe
PID 1988 wrote to memory of 2380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2672	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2672	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2672	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2596	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2596	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2596	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2460	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2460	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1988 wrote to memory of 2460	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\check.bat"

C:\Windows\system32\net.exe

net stop winmgmt /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\System32\Wbem\WMIC.exe

wmic baseboard get manufacturer, product, serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic bios get manufacturer, releasedate, serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get name, uuid

C:\Windows\System32\Wbem\WMIC.exe

wmic diskdrive get serialnumber

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win10v2004-20240508-en

Max time kernel

130s

Max time network

131s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\check.bat"

Signatures

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\system32\wbem\repository	C:\Windows\system32\svchost.exe	N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeAssignPrimaryTokenPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeAssignPrimaryTokenPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeAssignPrimaryTokenPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeAssignPrimaryTokenPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4864 wrote to memory of 3180	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\net.exe
PID 4864 wrote to memory of 3180	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\net.exe
PID 3180 wrote to memory of 1668	N/A	C:\Windows\system32\net.exe	C:\Windows\system32\net1.exe
PID 3180 wrote to memory of 1668	N/A	C:\Windows\system32\net.exe	C:\Windows\system32\net1.exe
PID 4864 wrote to memory of 3408	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 3408	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 1988	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 1988	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 2640	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 2640	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 312	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4864 wrote to memory of 312	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\check.bat"

C:\Windows\system32\net.exe

net stop winmgmt /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\System32\Wbem\WMIC.exe

wmic baseboard get manufacturer, product, serialnumber

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\Wbem\WMIC.exe

wmic bios get manufacturer, releasedate, serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get name, uuid

C:\Windows\System32\Wbem\WMIC.exe

wmic diskdrive get serialnumber

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
SE	184.31.15.184:443	www.bing.com	tcp
US	8.8.8.8:53	184.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	48.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:28

Platform

win10v2004-20240508-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe"

Signatures

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5296.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\segwindrv.inf	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5285.tmp	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5285.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5295.tmp	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5296.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\segwindrvx64.sys	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5295.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\segwindrv.cat	C:\Windows\system32\DrvInst.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Windows\system32\svchost.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Windows\system32\DrvInst.exe	N/A

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	C:\Windows\system32\svchost.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	C:\Windows\system32\svchost.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	C:\Windows\system32\svchost.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\system32\svchost.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	C:\Windows\system32\svchost.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	C:\Windows\system32\svchost.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	C:\Windows\system32\svchost.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\system32\svchost.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	C:\Windows\system32\svchost.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	C:\Windows\system32\svchost.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	C:\Windows\system32\DrvInst.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\svchost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4940 wrote to memory of 4536	N/A	C:\Windows\system32\svchost.exe	C:\Windows\system32\DrvInst.exe
PID 4940 wrote to memory of 4536	N/A	C:\Windows\system32\svchost.exe	C:\Windows\system32\DrvInst.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe

"C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d6762452-9f52-0b42-bc39-fcac7375ed0f}\segwindrv.inf" "9" "49f798bf3" "0000000000000158" "WinSta0\Default" "0000000000000174" "208" "c:\users\admin\appdata\local\temp\insyde"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "2" "211" "ROOT\INSYDESEG\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca1156c0ee7a:Insyde_Device64:6.1.7600.16385:{416c2604-443b-436f-9e1d-607bdc3cc785}\segwindrv," "49f798bf3" "0000000000000158"

Network

Files

C:\Users\Admin\AppData\Local\Temp\{d6762452-9f52-0b42-bc39-fcac7375ed0f}\segwindrv.inf

MD5	843fb7475608ce359da7cbd48fa3ab1d
SHA1	ae16643aa1756b34391e4c615958343ecb17b153
SHA256	e1449864c7403b9cd3d828c6fc9710fe1fbb3f35c7b6522a5dcbcf97685f40d7
SHA512	9db610ebff1ab1e24147abadf10f978eab95358f2b0806d17fb8df6e53723b0523dd26d0207430d029f5b6826a02c3a5d73ff01d8f6e28d53e82c230075f2b34

C:\Users\Admin\AppData\Local\Temp\{D6762~1\segwindrvx64.sys

MD5	e46dfe45c1714f4920d3fd2546f2f630
SHA1	28cdb0b48c1d88d71421ec9e40ce52836ab79956
SHA256	b44f4384f95cc9d3f86f0c27fc0abba9a291a7cc24483f41e70c1234bc61edc6
SHA512	97480d19e22ebef836e61f33d5540c41a08a9edc71af97a59fef71b3d60abd9ab78b32896ee0812cae1780da08f875e3cb32c048edf4fcae523fa04e23d2246c

C:\Windows\System32\DriverStore\Temp\{94e13124-2e25-ae48-9ac0-3bf435387f32}\SET5295.tmp

MD5	43d3603cf918445cbd1d7253b49bf527
SHA1	fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
SHA256	e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
SHA512	183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20240215-en

Max time kernel

121s

Max time network

123s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Insyde\segwindrvx64.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Insyde\segwindrvx64.sys

C:\Users\Admin\AppData\Local\Temp\Insyde\segwindrvx64.sys

C:\Users\Admin\AppData\Local\Temp\Insyde\segwindrvx64.sys

Network

N/A

Files

memory/2144-0-0x0000000000010000-0x000000000002A000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:29

Platform

win7-20240508-en

Max time kernel

27s

Max time network

17s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Insyde\spoof.bat"

Signatures

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\SET1F07.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\segwindrvx64.sys	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\SET1EF7.tmp	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\INFCACHE.0	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\SET1EF6.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\segwindrv.inf	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\SET1EF6.tmp	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\SET1EF7.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\segwindrv.inf_amd64_neutral_27984eece3494299\segwindrv.PNF	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\FileRepository\segwindrv.inf_amd64_neutral_27984eece3494299\segwindrv.PNF	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\segwindrv.cat	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\SET1F07.tmp	C:\Windows\system32\DrvInst.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\INF\setupapi.app.log	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.ev3	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.ev1	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\INF\oem2.inf	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\oem2.inf	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.ev1	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.ev3	C:\Windows\system32\DrvInst.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2428 wrote to memory of 2192	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe
PID 2428 wrote to memory of 2192	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe
PID 2428 wrote to memory of 2192	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe
PID 2108 wrote to memory of 2344	N/A	C:\Windows\system32\DrvInst.exe	C:\Windows\system32\rundll32.exe
PID 2108 wrote to memory of 2344	N/A	C:\Windows\system32\DrvInst.exe	C:\Windows\system32\rundll32.exe
PID 2108 wrote to memory of 2344	N/A	C:\Windows\system32\DrvInst.exe	C:\Windows\system32\rundll32.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Insyde\spoof.bat"

C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe

H2OSDE-Wx64.exe -SU AUTO

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5aa33940-8d03-67aa-4a1d-97617f37ea12}\segwindrv.inf" "9" "69f798bf3" "00000000000005A0" "WinSta0\Default" "0000000000000320" "208" "c:\users\admin\appdata\local\temp\insyde"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{38b0dee9-100c-122f-ad56-ed1f02d4ba5e} Global\{64745773-3c91-0e7a-f673-885e71693d10} C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\segwindrv.inf C:\Windows\System32\DriverStore\Temp\{63fecc06-405d-2ca9-351d-212953dbd554}\segwindrv.cat

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "00000000000005C4"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "2" "211" "ROOT\INSYDESEG\0000" "C:\Windows\INF\oem2.inf" "segwindrv.inf:Standard.NTamd64:Insyde_Device64:6.1.7600.16385:{416c2604-443b-436f-9e1d-607bdc3cc785}\segwindrv" "69f798bf3" "0000000000000394" "000000000000058C" "00000000000005C4"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\Cab1D91.tmp

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar1D94.tmp

MD5	435a9ac180383f9fa094131b173a2f7b
SHA1	76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256	67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512	1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Temp\{5aa33940-8d03-67aa-4a1d-97617f37ea12}\segwindrv.inf

MD5	843fb7475608ce359da7cbd48fa3ab1d
SHA1	ae16643aa1756b34391e4c615958343ecb17b153
SHA256	e1449864c7403b9cd3d828c6fc9710fe1fbb3f35c7b6522a5dcbcf97685f40d7
SHA512	9db610ebff1ab1e24147abadf10f978eab95358f2b0806d17fb8df6e53723b0523dd26d0207430d029f5b6826a02c3a5d73ff01d8f6e28d53e82c230075f2b34

C:\Users\Admin\AppData\Local\Temp\{5aa33940-8d03-67aa-4a1d-97617f37ea12}\segwindrv.cat

MD5	43d3603cf918445cbd1d7253b49bf527
SHA1	fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
SHA256	e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
SHA512	183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e

C:\Users\Admin\AppData\Local\Temp\{5AA33~1\segwindrvx64.sys

MD5	e46dfe45c1714f4920d3fd2546f2f630
SHA1	28cdb0b48c1d88d71421ec9e40ce52836ab79956
SHA256	b44f4384f95cc9d3f86f0c27fc0abba9a291a7cc24483f41e70c1234bc61edc6
SHA512	97480d19e22ebef836e61f33d5540c41a08a9edc71af97a59fef71b3d60abd9ab78b32896ee0812cae1780da08f875e3cb32c048edf4fcae523fa04e23d2246c

C:\Windows\Temp\Cab1F26.tmp

MD5	d59a6b36c5a94916241a3ead50222b6f
SHA1	e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256	a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA512	17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

C:\Windows\Temp\Tar1F29.tmp

MD5	b13f51572f55a2d31ed9f266d581e9ea
SHA1	7eef3111b878e159e520f34410ad87adecf0ca92
SHA256	725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512	f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

C:\Windows\System32\DriverStore\FileRepository\segwindrv.inf_amd64_neutral_27984eece3494299\segwindrv.PNF

MD5	2059fbfaf345defad74297265ed37f3b
SHA1	d470af278dd38796f3362919aa1d0b912f4c519b
SHA256	ea806908d270861b2e0da8b6330facaccf7cbd9188668c4d6df6c568bcfcabb7
SHA512	47f591561e0222649ba3cc0934e8f72a705a39c1fb63cf88367de6f0df17b5f6b3b9958dc7f38e2e52c2a11112a55cc3cf72407c96e035dd1fc1d1047ffa99d7

C:\Windows\System32\DriverStore\INFCACHE.1

MD5	94b9462e8cf9128512ac4a4a966611ba
SHA1	286460e540cc7cb13981a567c8692700cf8fec37
SHA256	71625bf60efb277f7ae47d2b2b6a0875ca0e200eb6ac1a3e55f3a930117c7a31
SHA512	fd46e54426751909d49502f94a6d39e6acc0315c8be33fe51c7d007d422b56313a37db9d7453c3a4e3d7ecbd8cab447bf721e6f6bf6e0a39573166a577d14dfa

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:28

Platform

win10v2004-20240426-en

Max time kernel

Max time network

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Insyde\spoof.bat"

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Insyde\spoof.bat"

C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe

H2OSDE-Wx64.exe -SU AUTO

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{988938a9-58bf-6c4d-993f-7bf082d5cdb4}\segwindrv.inf" "9" "49f798bf3" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\users\admin\appdata\local\temp\insyde"

C:\Windows\system32\DrvInst.exe

Network

Files

C:\Windows\System32\DriverStore\Temp\{0ca7684a-b67b-984d-b7e1-e2609782aeb9}\SET55F2.tmp

MD5	843fb7475608ce359da7cbd48fa3ab1d
SHA1	ae16643aa1756b34391e4c615958343ecb17b153
SHA256	e1449864c7403b9cd3d828c6fc9710fe1fbb3f35c7b6522a5dcbcf97685f40d7
SHA512	9db610ebff1ab1e24147abadf10f978eab95358f2b0806d17fb8df6e53723b0523dd26d0207430d029f5b6826a02c3a5d73ff01d8f6e28d53e82c230075f2b34

C:\Windows\System32\DriverStore\Temp\{0ca7684a-b67b-984d-b7e1-e2609782aeb9}\SET55F1.tmp

MD5	43d3603cf918445cbd1d7253b49bf527
SHA1	fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
SHA256	e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
SHA512	183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e

C:\Windows\System32\DriverStore\Temp\{0ca7684a-b67b-984d-b7e1-e2609782aeb9}\SET55E0.tmp

MD5	e46dfe45c1714f4920d3fd2546f2f630
SHA1	28cdb0b48c1d88d71421ec9e40ce52836ab79956
SHA256	b44f4384f95cc9d3f86f0c27fc0abba9a291a7cc24483f41e70c1234bc61edc6
SHA512	97480d19e22ebef836e61f33d5540c41a08a9edc71af97a59fef71b3d60abd9ab78b32896ee0812cae1780da08f875e3cb32c048edf4fcae523fa04e23d2246c

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\VHD\VHD.bat"

Signatures

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\vds.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\vds.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1712 wrote to memory of 2744	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\diskpart.exe
PID 1712 wrote to memory of 2744	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\diskpart.exe
PID 1712 wrote to memory of 2744	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\diskpart.exe
PID 1712 wrote to memory of 2484	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\control.exe
PID 1712 wrote to memory of 2484	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\control.exe
PID 1712 wrote to memory of 2484	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\control.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\VHD\VHD.bat"

C:\Windows\system32\diskpart.exe

diskpart /s 1.txt

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\control.exe

control /name Microsoft.StorageSpaces

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

96s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tweaks\1.bat"

Signatures

Modifies visibility of file extensions in Explorer

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	C:\Windows\system32\reg.exe	N/A

Modifies visiblity of hidden/system files in Explorer

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	C:\Windows\system32\reg.exe	N/A

UAC bypass

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Windows\system32\reg.exe	N/A

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallPaper	C:\Windows\system32\reg.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4780 wrote to memory of 224	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4780 wrote to memory of 224	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4780 wrote to memory of 348	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4780 wrote to memory of 348	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4780 wrote to memory of 688	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4780 wrote to memory of 688	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4780 wrote to memory of 1572	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\powercfg.exe
PID 4780 wrote to memory of 1572	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\powercfg.exe
PID 4780 wrote to memory of 3992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\reg.exe
PID 4780 wrote to memory of 3992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\reg.exe
PID 4780 wrote to memory of 2828	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4780 wrote to memory of 2828	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4780 wrote to memory of 5036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4780 wrote to memory of 5036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tweaks\1.bat"

C:\Windows\system32\bcdedit.exe

bcdedit /set bootuxdisabled yes

C:\Windows\system32\bcdedit.exe

bcdedit /set quietboot on

C:\Windows\system32\bcdedit.exe

bcdedit /timeout 0

C:\Windows\system32\powercfg.exe

powercfg h off

C:\Windows\system32\reg.exe

reg import 1.reg

C:\Windows\system32\takeown.exe

takeown /F C:\Windows\System32\dbgeng.dll

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\dbgeng.dll /grant Administrators:D

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	249.138.73.23.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	43.229.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20240220-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.exe"

Signatures

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.exe

"C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.exe"

Signatures

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.exe

"C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	100.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	194.98.74.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win10v2004-20240508-en

Max time kernel

131s

Max time network

102s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\AMI\amigendrv64.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\AMI\amigendrv64.sys

C:\Users\Admin\AppData\Local\Temp\AMI\amigendrv64.sys

C:\Users\Admin\AppData\Local\Temp\AMI\amigendrv64.sys

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	100.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
SE	184.31.15.184:443	www.bing.com	tcp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	184.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"

Signatures

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2208 wrote to memory of 2028	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
PID 2208 wrote to memory of 2028	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
PID 2208 wrote to memory of 2028	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"

C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE

AMIDEWINx64.exe /SU AUTO

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20240220-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe"

Signatures

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\SETA30.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\segwindrv.inf	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\SETA2F.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\segwindrv.cat	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\SETA30.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\SETA1E.tmp	C:\Windows\system32\DrvInst.exe	N/A
File created	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\SETA1E.tmp	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\segwindrvx64.sys	C:\Windows\system32\DrvInst.exe	N/A
File opened for modification	C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\SETA2F.tmp	C:\Windows\system32\DrvInst.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\INF\setupapi.app.log	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
File opened for modification	C:\Windows\INF\setupapi.dev.log	C:\Windows\system32\DrvInst.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	C:\Windows\system32\DrvInst.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	C:\Windows\system32\DrvInst.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\rundll32.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\DrvInst.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\rundll32.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1588 wrote to memory of 1724	N/A	C:\Windows\system32\DrvInst.exe	C:\Windows\system32\rundll32.exe
PID 1588 wrote to memory of 1724	N/A	C:\Windows\system32\DrvInst.exe	C:\Windows\system32\rundll32.exe
PID 1588 wrote to memory of 1724	N/A	C:\Windows\system32\DrvInst.exe	C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe

"C:\Users\Admin\AppData\Local\Temp\Insyde\H2OSDE-Wx64.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7a67e499-1071-070e-8b30-1a24bd8cc25d}\segwindrv.inf" "9" "69f798bf3" "000000000000053C" "WinSta0\Default" "000000000000052C" "208" "c:\users\admin\appdata\local\temp\insyde"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{12bca60f-5ed6-02aa-20f8-7365b9f42809} Global\{7052c5ef-6bfd-3700-6923-666c6923666c} C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\segwindrv.inf C:\Windows\System32\DriverStore\Temp\{119b05b0-8794-28c2-4aed-b76f623cbf46}\segwindrv.cat

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\Cab917.tmp

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar939.tmp

MD5	9c0c641c06238516f27941aa1166d427
SHA1	64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256	4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512	936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\{7a67e499-1071-070e-8b30-1a24bd8cc25d}\segwindrv.inf

MD5	843fb7475608ce359da7cbd48fa3ab1d
SHA1	ae16643aa1756b34391e4c615958343ecb17b153
SHA256	e1449864c7403b9cd3d828c6fc9710fe1fbb3f35c7b6522a5dcbcf97685f40d7
SHA512	9db610ebff1ab1e24147abadf10f978eab95358f2b0806d17fb8df6e53723b0523dd26d0207430d029f5b6826a02c3a5d73ff01d8f6e28d53e82c230075f2b34

C:\Users\Admin\AppData\Local\Temp\{7a67e499-1071-070e-8b30-1a24bd8cc25d}\segwindrv.cat

MD5	43d3603cf918445cbd1d7253b49bf527
SHA1	fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
SHA256	e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
SHA512	183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e

C:\Users\Admin\AppData\Local\Temp\{7A67E~1\segwindrvx64.sys

MD5	e46dfe45c1714f4920d3fd2546f2f630
SHA1	28cdb0b48c1d88d71421ec9e40ce52836ab79956
SHA256	b44f4384f95cc9d3f86f0c27fc0abba9a291a7cc24483f41e70c1234bc61edc6
SHA512	97480d19e22ebef836e61f33d5540c41a08a9edc71af97a59fef71b3d60abd9ab78b32896ee0812cae1780da08f875e3cb32c048edf4fcae523fa04e23d2246c

C:\Windows\Temp\CabA8E.tmp

MD5	d59a6b36c5a94916241a3ead50222b6f
SHA1	e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256	a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA512	17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

C:\Windows\Temp\TarAA0.tmp

MD5	b13f51572f55a2d31ed9f266d581e9ea
SHA1	7eef3111b878e159e520f34410ad87adecf0ca92
SHA256	725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512	f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win7-20240221-en

Max time kernel

118s

Max time network

120s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\tweaks\1.bat"

Signatures

Modifies visibility of file extensions in Explorer

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	C:\Windows\system32\reg.exe	N/A

Modifies visiblity of hidden/system files in Explorer

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	C:\Windows\system32\reg.exe	N/A

UAC bypass

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	C:\Windows\system32\reg.exe	N/A

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\WallPaper	C:\Windows\system32\reg.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\system32\powercfg.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2864 wrote to memory of 2120	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2120	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2120	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2220	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2220	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2220	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2900	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2900	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2900	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2864 wrote to memory of 2928	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\powercfg.exe
PID 2864 wrote to memory of 2928	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\powercfg.exe
PID 2864 wrote to memory of 2928	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\powercfg.exe
PID 2864 wrote to memory of 2068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\reg.exe
PID 2864 wrote to memory of 2068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\reg.exe
PID 2864 wrote to memory of 2068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\reg.exe
PID 2864 wrote to memory of 2588	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 2864 wrote to memory of 2588	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 2864 wrote to memory of 2588	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 2864 wrote to memory of 2600	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 2864 wrote to memory of 2600	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 2864 wrote to memory of 2600	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\tweaks\1.bat"

C:\Windows\system32\bcdedit.exe

bcdedit /set bootuxdisabled yes

C:\Windows\system32\bcdedit.exe

bcdedit /set quietboot on

C:\Windows\system32\bcdedit.exe

bcdedit /timeout 0

C:\Windows\system32\powercfg.exe

powercfg h off

C:\Windows\system32\reg.exe

reg import 1.reg

C:\Windows\system32\takeown.exe

takeown /F C:\Windows\System32\dbgeng.dll

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\dbgeng.dll /grant Administrators:D

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-28 21:24

Reported

2024-05-28 21:31

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

137s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"

Signatures

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3744 wrote to memory of 1504	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
PID 3744 wrote to memory of 1504	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"

C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE

AMIDEWINx64.exe /SU AUTO

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	100.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	48.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	216.131.50.23.in-addr.arpa	udp

Files

N/A

Sample ID	240528-z833pacg9z
Target	spoof_2.zip
SHA256	022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36
Tags	discovery evasion exploit ransomware trojan

Malware Analysis Report

2024-09-11 05:58

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview