Malware Analysis Report

2024-11-16 13:40

Sample ID 240601-ew76nahf9t
Target Lunar Release.rar
SHA256 64e46e6863b3ba7f96922329112d82df37ebbfe9b538407fdb8ed02443a99a82
Tags
xmrig xworm evasion execution miner persistence pyinstaller rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

64e46e6863b3ba7f96922329112d82df37ebbfe9b538407fdb8ed02443a99a82

Threat Level: Known bad

The file Lunar Release.rar was found to be: Known bad.

Malicious Activity Summary

xmrig xworm evasion execution miner persistence pyinstaller rat trojan upx

Modifies security service

Xworm

Detect Xworm Payload

xmrig

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Stops running service(s)

Creates new service(s)

Sets service image path in registry

Loads dropped DLL

Drops startup file

Executes dropped EXE

UPX packed file

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Command and Scripting Interpreter: JavaScript

Detects Pyinstaller

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 04:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:22

Platform

win7-20240215-en

Max time kernel

210s

Max time network

208s

Command Line

winlogon.exe

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies security service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP C:\Windows\System32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection C:\Windows\System32\svchost.exe N/A

Xworm

trojan rat xworm

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\YWZWALUU\ImagePath = "C:\\ProgramData\\bbskkvrqdoji\\fdjrmaypnxal.exe" C:\Windows\system32\services.exe N/A

Stops running service(s)

evasion execution

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\num2.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\AMD Graphics Manager = "C:\\Users\\Admin\\AppData\\Roaming\\AMD Graphics Manager" C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\PerfStringBackup.TMP C:\Windows\system32\wbem\WMIADAP.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf C:\Windows\system32\svchost.exe N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 60ba50e3dab3da01 C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2268 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2268 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2268 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2672 wrote to memory of 2456 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2672 wrote to memory of 2456 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2672 wrote to memory of 2456 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2672 wrote to memory of 2456 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2672 wrote to memory of 2868 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2672 wrote to memory of 2868 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2672 wrote to memory of 2868 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2672 wrote to memory of 2868 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2672 wrote to memory of 2836 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2672 wrote to memory of 2836 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2672 wrote to memory of 2836 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2672 wrote to memory of 2836 N/A C:\Users\Admin\Desktop\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2836 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 2836 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 2836 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2836 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 2836 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 2836 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 1280 wrote to memory of 2196 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 1280 wrote to memory of 1296 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 1280 wrote to memory of 1296 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 1280 wrote to memory of 1296 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 1280 wrote to memory of 1296 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 1280 wrote to memory of 1296 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2456 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 2456 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 2456 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 2720 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2720 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2720 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 628 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2040 wrote to memory of 436 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 484 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 492 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 500 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 600 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 748 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 816 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 852 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 964 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 240 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 112 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 2040 wrote to memory of 1068 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 1120 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\taskhost.exe
PID 2040 wrote to memory of 1180 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\Dwm.exe
PID 2040 wrote to memory of 1216 N/A C:\Windows\system32\dialer.exe C:\Windows\Explorer.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Lunar Release.rar"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1427141436-1022863156-9543669312004651000-886009830-13344380811106055862075831902"

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Lunar Release.rar"

C:\Users\Admin\Desktop\Lunar Release V1.2.exe

"C:\Users\Admin\Desktop\Lunar Release V1.2.exe"

C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

"C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe"

C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe

"C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe"

C:\Users\Admin\AppData\Local\Temp\num2.EXE

"C:\Users\Admin\AppData\Local\Temp\num2.EXE"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "HDNFMUHS"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "HDNFMUHS"

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AMD Graphics Manager" /tr "C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "819728718-9262043133772636421313969478-1102695162-1909989589316626167-1782576890"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1295497222208338654214180403861941831073-257235045538981833248887501859445967"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "102175728615419426705576337598494355716143717184618063461288982042339944776"

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "YWZWALUU"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "YWZWALUU"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-662215195-2020781763-1178239942-13335991541154280684526851569-1622248139110434691"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-11427857014917733272120267419-697972884-1972423211-10697976271534870488-1280302135"

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-2949552327256384491373368198-1237828061774003023-8534344942147033653-692702069"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-844061442-1515339252-813295746969036665-382607228212874878316128547021001460473"

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1753166678-5030038094226342831291388184676048760831058148482376826-1251857542"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "606374902-15419034381103134558-961626878-1048017559-645429046-576760818-1795339093"

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "691646025-14088242881000554401-990353402-1644521212-1802586560-1807671777-1338872194"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1577153409-12027467661850587546242102181-66721984215775438630595727451182301"

C:\Windows\system32\dialer.exe

dialer.exe

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

C:\Windows\system32\taskeng.exe

taskeng.exe {0AE8090E-8CD2-485D-B558-B28AFB45AF5F} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\yglqub.exe

"C:\Users\Admin\AppData\Local\Temp\yglqub.exe"

C:\Users\Admin\AppData\Local\Temp\yglqub.exe

"C:\Users\Admin\AppData\Local\Temp\yglqub.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
DE 95.179.241.203:80 pool.hashvault.pro tcp
NL 91.92.241.69:5555 tcp

Files

C:\Users\Admin\Desktop\Lunar Release V1.2.exe

MD5 8f92f2e13f44e95c08a3b3309e98a361
SHA1 e2cb9a931b39cafbdcd974758638772b611e5d3a
SHA256 6a7eff69ef4f70f363c1585dedfbcd76708577e78e292c62203a758f8ae377b3
SHA512 42cdbd1ff0b58f6ea0ded8a1c27d62b75844138b65ba894127c1f5a117f8c1c876469bf3f3229986ddfcbf516037ac04a82180ad1e23ff4b93db917b7ce475b0

\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

MD5 9ac62ff292d4ae060777d8fa192a5bbc
SHA1 37039579fd2940f2b7965d65fcbfb12bfec6aaee
SHA256 691fcb5dfa44d54d8e233989ef826d164bd0f3002052c0011b2698f4b5a2b062
SHA512 e81ec0bf563e85e127b1d3ed397426d4225eb3df697fa96e125d2bdaebd8c1f2c9b0604189fc8a6eae11f362eb293f7185344e4859c403a001cc0e71dfa1c60b

\Users\Admin\AppData\Local\Temp\LunarExecutor.exe

MD5 1799672512d979b9e42c59cf585cbb10
SHA1 c11ed2acd408521f61e359456eb67b1f6bb7ad81
SHA256 afb7c6a1ecc819d8727b24229f74db0d430d40d1062342bd31e2495dc496adc4
SHA512 7bf6a2688e953dcd73819769acbbada305216bce540c20a3d6eaa8a6942000a29651c8a16a8f9640be8d8185a0a05787d75223cb612065cf0051c8be46f134d9

memory/2456-40-0x0000000000C30000-0x0000000000C46000-memory.dmp

\Users\Admin\AppData\Local\Temp\num2.EXE

MD5 e6fe75c4390d3970545f0fdbb3274244
SHA1 8b6ed33f1778800cf0549bd7214249bdb81fbb58
SHA256 48aaa21d99bf5fb15abc6945911438e5f3ac4c378ac89bc4eb850200f9f648d5
SHA512 17b0911f13a1348e6511faf412f63721e7df7b196ae3a6acb86789eb04a2f8a90a42a6931a0c0ad45ee98910c4661c6db7e43623c560a963cd4d021ce9b1ad20

\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

MD5 1994ad04639f3d12c7bbfa37feb3434f
SHA1 4979247e5a9771286a91827851527e5dbfb80c8e
SHA256 c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
SHA512 adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

MD5 19c095e1c399bdaa0663caa9162f0b0e
SHA1 cb5504712ec965f7c43883f2f251823755b1e37e
SHA256 38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512 a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

memory/2196-62-0x0000000140000000-0x000000014000D000-memory.dmp

memory/2196-61-0x0000000140000000-0x000000014000D000-memory.dmp

memory/2196-60-0x0000000140000000-0x000000014000D000-memory.dmp

memory/1296-75-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-77-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-79-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-81-0x0000000000740000-0x0000000000760000-memory.dmp

memory/1296-82-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-83-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-86-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-85-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-84-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-80-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-78-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-76-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-74-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2196-59-0x0000000140000000-0x000000014000D000-memory.dmp

memory/2196-71-0x0000000140000000-0x000000014000D000-memory.dmp

memory/2196-70-0x0000000140000000-0x000000014000D000-memory.dmp

memory/1296-88-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1296-87-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3052-97-0x0000000001E30000-0x0000000001E38000-memory.dmp

memory/3052-96-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

memory/2040-101-0x0000000140000000-0x000000014002B000-memory.dmp

memory/492-128-0x00000000374B0000-0x00000000374C0000-memory.dmp

memory/2952-405-0x000000001A1C0000-0x000000001A4A2000-memory.dmp

memory/2952-406-0x00000000009B0000-0x00000000009B8000-memory.dmp

memory/492-127-0x000007FEBF670000-0x000007FEBF680000-memory.dmp

memory/492-126-0x0000000000230000-0x000000000025B000-memory.dmp

memory/484-121-0x00000000374B0000-0x00000000374C0000-memory.dmp

memory/484-120-0x000007FEBF670000-0x000007FEBF680000-memory.dmp

memory/484-119-0x00000000000E0000-0x000000000010B000-memory.dmp

memory/436-117-0x00000000374B0000-0x00000000374C0000-memory.dmp

memory/436-116-0x000007FEBF670000-0x000007FEBF680000-memory.dmp

memory/436-115-0x0000000000DF0000-0x0000000000E1B000-memory.dmp

memory/436-111-0x0000000000C00000-0x0000000000C24000-memory.dmp

memory/436-109-0x0000000000C00000-0x0000000000C24000-memory.dmp

memory/2040-106-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2040-100-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2040-99-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2040-105-0x0000000077250000-0x000000007736F000-memory.dmp

memory/2040-104-0x0000000077470000-0x0000000077619000-memory.dmp

memory/2040-103-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2040-98-0x0000000140000000-0x000000014002B000-memory.dmp

C:\Windows\System32\perfc011.dat

MD5 1f998386566e5f9b7f11cc79254d1820
SHA1 e1da5fe1f305099b94de565d06bc6f36c6794481
SHA256 1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512 a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 46d08e3a55f007c523ac64dce6dcf478
SHA1 62edf88697e98d43f32090a2197bead7e7244245
SHA256 5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512 b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

C:\Windows\System32\perfh007.dat

MD5 b69ab3aeddb720d6ef8c05ff88c23b38
SHA1 d830c2155159656ed1806c7c66cae2a54a2441fa
SHA256 24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA512 4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

C:\Windows\System32\perfh00C.dat

MD5 5f684ce126de17a7d4433ed2494c5ca9
SHA1 ce1a30a477daa1bac2ec358ce58731429eafe911
SHA256 2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA512 4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

C:\Windows\System32\perfh011.dat

MD5 54c674d19c0ff72816402f66f6c3d37c
SHA1 2dcc0269545a213648d59dc84916d9ec2d62a138
SHA256 646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA512 4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

C:\Windows\System32\perfh010.dat

MD5 4623482c106cf6cc1bac198f31787b65
SHA1 5abb0decf7b42ef5daf7db012a742311932f6dad
SHA256 eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512 afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

C:\Windows\System32\perfc010.dat

MD5 d73172c6cb697755f87cd047c474cf91
SHA1 abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA256 9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA512 7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

C:\Windows\System32\perfc00C.dat

MD5 ce233fa5dc5adcb87a5185617a0ff6ac
SHA1 2e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA256 68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA512 1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

C:\Windows\System32\perfh00A.dat

MD5 7d0bac4e796872daa3f6dc82c57f4ca8
SHA1 b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256 ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512 145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

C:\Windows\System32\perfc00A.dat

MD5 f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1 961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256 cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512 116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294

C:\Windows\System32\perfh009.dat

MD5 aecab86cc5c705d7a036cba758c1d7b0
SHA1 e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA256 9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512 e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

C:\Windows\System32\perfc007.dat

MD5 19c7052de3b7281b4c1c6bfbb543c5dc
SHA1 d2e12081a14c1069c89f2cee7357a559c27786e7
SHA256 14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512 289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83

\Users\Admin\AppData\Local\Temp\yglqub.exe

MD5 ee25fe052ea3b5b96ec28175d35192b4
SHA1 4bab70cef82b9132104bbbd60758debff5eb4492
SHA256 74e4938f2316f8e55e906096527defb3def39160890c7d81f59f7d29bb179589
SHA512 a20bcad2a5aba95268c2253a23e194480e5ba477586d57e74a9411b1ced05c81782c61e5748451813526f83fc809616079f39b4fd187d6ff0329ac0fdb09958b

C:\Users\Admin\AppData\Local\Temp\_MEI16482\python312.dll

MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

\Users\Admin\AppData\Local\Temp\_MEI16482\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

\Users\Admin\AppData\Local\Temp\_MEI16482\api-ms-win-core-timezone-l1-1-0.dll

MD5 d12403ee11359259ba2b0706e5e5111c
SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

\Users\Admin\AppData\Local\Temp\_MEI16482\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

\Users\Admin\AppData\Local\Temp\_MEI16482\api-ms-win-core-processthreads-l1-1-1.dll

MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

\Users\Admin\AppData\Local\Temp\_MEI16482\api-ms-win-core-localization-l1-2-0.dll

MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

\Users\Admin\AppData\Local\Temp\_MEI16482\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win10v2004-20240508-en

Max time kernel

130s

Max time network

117s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Lunar Release.rar"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Lunar Release.rar"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

95s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\ByfronHook.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\ByfronHook.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win7-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

winlogon.exe

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies security service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP C:\Windows\System32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection C:\Windows\System32\svchost.exe N/A

Xworm

trojan rat xworm

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\YWZWALUU\ImagePath = "C:\\ProgramData\\bbskkvrqdoji\\fdjrmaypnxal.exe" C:\Windows\system32\services.exe N/A

Stops running service(s)

evasion execution

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\num2.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\AMD Graphics Manager = "C:\\Users\\Admin\\AppData\\Roaming\\AMD Graphics Manager" C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\perfc007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
File created C:\Windows\system32\perfc010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\PerfStringBackup.TMP C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf C:\Windows\system32\svchost.exe N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 9044aadedab3da01 C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\wbem\wmiprvse.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2040 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2040 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2040 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 2040 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2040 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2040 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2040 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 2040 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2040 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2040 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2040 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 2180 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 2180 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 2180 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 2180 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 2180 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 2180 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 3020 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 2564 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 2564 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 2564 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 2564 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 2564 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2188 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 2188 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 2188 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 1120 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 1120 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 1120 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2684 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 2960 wrote to memory of 432 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 2960 wrote to memory of 476 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\services.exe
PID 2960 wrote to memory of 492 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 2960 wrote to memory of 500 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsm.exe
PID 2960 wrote to memory of 604 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 672 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 748 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 2960 wrote to memory of 820 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 2960 wrote to memory of 848 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 972 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 276 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 840 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 2960 wrote to memory of 1080 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 1092 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\taskhost.exe
PID 2960 wrote to memory of 1168 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\Dwm.exe
PID 2960 wrote to memory of 1204 N/A C:\Windows\system32\dialer.exe C:\Windows\Explorer.EXE
PID 2960 wrote to memory of 2340 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2960 wrote to memory of 2332 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sppsvc.exe
PID 2960 wrote to memory of 2188 N/A C:\Windows\system32\dialer.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe"

C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

"C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe"

C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe

"C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe"

C:\Users\Admin\AppData\Local\Temp\num2.EXE

"C:\Users\Admin\AppData\Local\Temp\num2.EXE"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "HDNFMUHS"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "HDNFMUHS"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AMD Graphics Manager" /tr "C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-6326472124916531921847896149-2091483932189129920510380141754238702-1253524409"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-23097492880803816-1358032847-1960672110681194711390647647-650876018537480427"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "282218998861667838415083388-1238744921-114117622-196742679118462037011348189542"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-7147283889080831041741299947-27956229651768040211108451110780285131637554560"

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "YWZWALUU"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-14360423371261684366-66117701910400583871121131861814115432-915725919-391823980"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "313889541200128222-20080771541612704374-1388164577-39979168-137424043-1772855405"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "YWZWALUU"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "13436483421878006620546719780181040181-13878342281817936938-20757748-1752906916"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1666473985-8337606046395682088562870521027711789543135170-13071317401134580124"

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1364041648-555175473-7806759441617815069839832868-1973975336-1501680884302697934"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1332237246-1649294900-2112671856-1952574740-10408600771883674268-890833771-1008735711"

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-381938930-107167682-148765511-55369428813547334701641595235285375817-993982181"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-162701195-1740089095-411702300444126329-1000274302-143603283115985521150563057"

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-20211372887856982254890170921422202661655538946-539722721-1346520221179902697"

C:\Windows\system32\dialer.exe

dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1963696509-20054230538523116391479180814742532931652808569956633573-476600201"

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

C:\Windows\system32\taskeng.exe

taskeng.exe {45C679CB-5B77-47F3-9765-4E8BB1E31A4B} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\zpakjb.exe

"C:\Users\Admin\AppData\Local\Temp\zpakjb.exe"

C:\Users\Admin\AppData\Local\Temp\zpakjb.exe

"C:\Users\Admin\AppData\Local\Temp\zpakjb.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
NL 91.92.241.69:5555 tcp
DE 95.179.241.203:80 pool.hashvault.pro tcp

Files

\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

MD5 9ac62ff292d4ae060777d8fa192a5bbc
SHA1 37039579fd2940f2b7965d65fcbfb12bfec6aaee
SHA256 691fcb5dfa44d54d8e233989ef826d164bd0f3002052c0011b2698f4b5a2b062
SHA512 e81ec0bf563e85e127b1d3ed397426d4225eb3df697fa96e125d2bdaebd8c1f2c9b0604189fc8a6eae11f362eb293f7185344e4859c403a001cc0e71dfa1c60b

memory/2188-8-0x000007FEF6093000-0x000007FEF6094000-memory.dmp

\Users\Admin\AppData\Local\Temp\LunarExecutor.exe

MD5 1799672512d979b9e42c59cf585cbb10
SHA1 c11ed2acd408521f61e359456eb67b1f6bb7ad81
SHA256 afb7c6a1ecc819d8727b24229f74db0d430d40d1062342bd31e2495dc496adc4
SHA512 7bf6a2688e953dcd73819769acbbada305216bce540c20a3d6eaa8a6942000a29651c8a16a8f9640be8d8185a0a05787d75223cb612065cf0051c8be46f134d9

\Users\Admin\AppData\Local\Temp\num2.EXE

MD5 e6fe75c4390d3970545f0fdbb3274244
SHA1 8b6ed33f1778800cf0549bd7214249bdb81fbb58
SHA256 48aaa21d99bf5fb15abc6945911438e5f3ac4c378ac89bc4eb850200f9f648d5
SHA512 17b0911f13a1348e6511faf412f63721e7df7b196ae3a6acb86789eb04a2f8a90a42a6931a0c0ad45ee98910c4661c6db7e43623c560a963cd4d021ce9b1ad20

memory/2188-17-0x0000000000100000-0x0000000000116000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

MD5 1994ad04639f3d12c7bbfa37feb3434f
SHA1 4979247e5a9771286a91827851527e5dbfb80c8e
SHA256 c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
SHA512 adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

MD5 19c095e1c399bdaa0663caa9162f0b0e
SHA1 cb5504712ec965f7c43883f2f251823755b1e37e
SHA256 38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512 a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

memory/3020-43-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3020-42-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3020-46-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3020-41-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3020-40-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3020-39-0x0000000140000000-0x000000014000D000-memory.dmp

memory/2564-49-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-48-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-50-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-52-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-55-0x00000000000B0000-0x00000000000D0000-memory.dmp

memory/2564-54-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-56-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-53-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-51-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-60-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-59-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-58-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-57-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-61-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2564-62-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1860-70-0x000000001B4B0000-0x000000001B792000-memory.dmp

memory/1860-71-0x00000000022E0000-0x00000000022E8000-memory.dmp

memory/2960-79-0x0000000077B60000-0x0000000077C7F000-memory.dmp

memory/2960-75-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2960-74-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2960-73-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2960-72-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2960-78-0x0000000077C80000-0x0000000077E29000-memory.dmp

memory/2960-77-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2960-80-0x0000000140000000-0x000000014002B000-memory.dmp

memory/476-95-0x0000000037CC0000-0x0000000037CD0000-memory.dmp

memory/476-94-0x000007FEBFD20000-0x000007FEBFD30000-memory.dmp

memory/476-93-0x0000000000BA0000-0x0000000000BCB000-memory.dmp

memory/432-91-0x0000000037CC0000-0x0000000037CD0000-memory.dmp

memory/432-90-0x000007FEBFD20000-0x000007FEBFD30000-memory.dmp

memory/432-89-0x0000000000BB0000-0x0000000000BDB000-memory.dmp

memory/432-85-0x0000000000610000-0x0000000000634000-memory.dmp

memory/432-83-0x0000000000610000-0x0000000000634000-memory.dmp

memory/492-111-0x0000000037CC0000-0x0000000037CD0000-memory.dmp

memory/492-110-0x000007FEBFD20000-0x000007FEBFD30000-memory.dmp

memory/492-109-0x00000000000C0000-0x00000000000EB000-memory.dmp

memory/2092-398-0x000000001A150000-0x000000001A432000-memory.dmp

memory/2092-403-0x0000000000640000-0x0000000000648000-memory.dmp

memory/2188-629-0x000007FEF6093000-0x000007FEF6094000-memory.dmp

C:\Windows\System32\perfc011.dat

MD5 1f998386566e5f9b7f11cc79254d1820
SHA1 e1da5fe1f305099b94de565d06bc6f36c6794481
SHA256 1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512 a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 46d08e3a55f007c523ac64dce6dcf478
SHA1 62edf88697e98d43f32090a2197bead7e7244245
SHA256 5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512 b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

C:\Windows\System32\perfh00C.dat

MD5 5f684ce126de17a7d4433ed2494c5ca9
SHA1 ce1a30a477daa1bac2ec358ce58731429eafe911
SHA256 2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA512 4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

C:\Windows\System32\perfh011.dat

MD5 54c674d19c0ff72816402f66f6c3d37c
SHA1 2dcc0269545a213648d59dc84916d9ec2d62a138
SHA256 646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA512 4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

C:\Windows\System32\perfh010.dat

MD5 4623482c106cf6cc1bac198f31787b65
SHA1 5abb0decf7b42ef5daf7db012a742311932f6dad
SHA256 eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512 afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

C:\Windows\System32\perfc010.dat

MD5 d73172c6cb697755f87cd047c474cf91
SHA1 abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA256 9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA512 7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

C:\Windows\System32\perfc00C.dat

MD5 ce233fa5dc5adcb87a5185617a0ff6ac
SHA1 2e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA256 68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA512 1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

C:\Windows\System32\perfh00A.dat

MD5 7d0bac4e796872daa3f6dc82c57f4ca8
SHA1 b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256 ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512 145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

C:\Windows\System32\perfc00A.dat

MD5 f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1 961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256 cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512 116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294

C:\Windows\System32\perfh009.dat

MD5 aecab86cc5c705d7a036cba758c1d7b0
SHA1 e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA256 9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512 e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

C:\Windows\System32\perfh007.dat

MD5 b69ab3aeddb720d6ef8c05ff88c23b38
SHA1 d830c2155159656ed1806c7c66cae2a54a2441fa
SHA256 24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA512 4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

C:\Windows\System32\perfc007.dat

MD5 19c7052de3b7281b4c1c6bfbb543c5dc
SHA1 d2e12081a14c1069c89f2cee7357a559c27786e7
SHA256 14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512 289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83

\Users\Admin\AppData\Local\Temp\zpakjb.exe

MD5 ee25fe052ea3b5b96ec28175d35192b4
SHA1 4bab70cef82b9132104bbbd60758debff5eb4492
SHA256 74e4938f2316f8e55e906096527defb3def39160890c7d81f59f7d29bb179589
SHA512 a20bcad2a5aba95268c2253a23e194480e5ba477586d57e74a9411b1ced05c81782c61e5748451813526f83fc809616079f39b4fd187d6ff0329ac0fdb09958b

C:\Users\Admin\AppData\Local\Temp\_MEI5562\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI5562\python312.dll

MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

\Users\Admin\AppData\Local\Temp\_MEI5562\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

\Users\Admin\AppData\Local\Temp\_MEI5562\api-ms-win-core-timezone-l1-1-0.dll

MD5 d12403ee11359259ba2b0706e5e5111c
SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

\Users\Admin\AppData\Local\Temp\_MEI5562\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

\Users\Admin\AppData\Local\Temp\_MEI5562\api-ms-win-core-processthreads-l1-1-1.dll

MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

\Users\Admin\AppData\Local\Temp\_MEI5562\api-ms-win-core-localization-l1-2-0.dll

MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win10v2004-20240508-en

Max time kernel

15s

Max time network

151s

Command Line

winlogon.exe

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Stops running service(s)

evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\num2.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AMD Graphics Manager = "C:\\Users\\Admin\\AppData\\Roaming\\AMD Graphics Manager" C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable C:\Windows\System32\RuntimeBroker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System C:\Windows\System32\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1" C:\Windows\system32\sihost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1336 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 1336 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe
PID 1336 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 1336 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe
PID 1336 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 1336 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe C:\Users\Admin\AppData\Local\Temp\num2.EXE
PID 940 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 940 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 940 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 940 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\num2.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 3748 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3344 wrote to memory of 5684 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3344 wrote to memory of 5684 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3344 wrote to memory of 5684 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3344 wrote to memory of 5684 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3344 wrote to memory of 5684 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 4824 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4824 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4504 wrote to memory of 5292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4272 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 4272 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe C:\Windows\System32\schtasks.exe
PID 5292 wrote to memory of 636 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 5292 wrote to memory of 688 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 5292 wrote to memory of 960 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 64 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\dwm.exe
PID 5292 wrote to memory of 528 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1036 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1052 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1068 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1168 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1188 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1264 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1296 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1368 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1424 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1464 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1476 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1508 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1648 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1716 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1728 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1808 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1816 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 2008 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 2028 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1364 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 1692 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 5292 wrote to memory of 1772 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 5292 wrote to memory of 2128 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 5292 wrote to memory of 2204 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe"

C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

"C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe"

C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe

"C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe"

C:\Users\Admin\AppData\Local\Temp\num2.EXE

"C:\Users\Admin\AppData\Local\Temp\num2.EXE"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "HDNFMUHS"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "HDNFMUHS"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "YWZWALUU"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AMD Graphics Manager" /tr "C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "YWZWALUU"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Local\Temp\fgksno.exe

"C:\Users\Admin\AppData\Local\Temp\fgksno.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
NL 91.92.241.69:5555 tcp
US 8.8.8.8:53 69.241.92.91.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe

MD5 9ac62ff292d4ae060777d8fa192a5bbc
SHA1 37039579fd2940f2b7965d65fcbfb12bfec6aaee
SHA256 691fcb5dfa44d54d8e233989ef826d164bd0f3002052c0011b2698f4b5a2b062
SHA512 e81ec0bf563e85e127b1d3ed397426d4225eb3df697fa96e125d2bdaebd8c1f2c9b0604189fc8a6eae11f362eb293f7185344e4859c403a001cc0e71dfa1c60b

C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe

MD5 1799672512d979b9e42c59cf585cbb10
SHA1 c11ed2acd408521f61e359456eb67b1f6bb7ad81
SHA256 afb7c6a1ecc819d8727b24229f74db0d430d40d1062342bd31e2495dc496adc4
SHA512 7bf6a2688e953dcd73819769acbbada305216bce540c20a3d6eaa8a6942000a29651c8a16a8f9640be8d8185a0a05787d75223cb612065cf0051c8be46f134d9

memory/4272-16-0x00007FFA03793000-0x00007FFA03795000-memory.dmp

memory/4272-22-0x0000000000310000-0x0000000000326000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\num2.EXE

MD5 e6fe75c4390d3970545f0fdbb3274244
SHA1 8b6ed33f1778800cf0549bd7214249bdb81fbb58
SHA256 48aaa21d99bf5fb15abc6945911438e5f3ac4c378ac89bc4eb850200f9f648d5
SHA512 17b0911f13a1348e6511faf412f63721e7df7b196ae3a6acb86789eb04a2f8a90a42a6931a0c0ad45ee98910c4661c6db7e43623c560a963cd4d021ce9b1ad20

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

MD5 1994ad04639f3d12c7bbfa37feb3434f
SHA1 4979247e5a9771286a91827851527e5dbfb80c8e
SHA256 c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
SHA512 adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

MD5 19c095e1c399bdaa0663caa9162f0b0e
SHA1 cb5504712ec965f7c43883f2f251823755b1e37e
SHA256 38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512 a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

memory/3748-47-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3748-46-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3748-45-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3748-44-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3748-43-0x0000000140000000-0x000000014000D000-memory.dmp

memory/5684-54-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-51-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-55-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-57-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-58-0x0000017A52B70000-0x0000017A52B90000-memory.dmp

memory/5684-56-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-53-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3748-50-0x0000000140000000-0x000000014000D000-memory.dmp

memory/5684-52-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-59-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-60-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-61-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-63-0x0000000140000000-0x0000000140848000-memory.dmp

memory/5684-62-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1924-69-0x000001C05BA10000-0x000001C05BA32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_azdvyt13.2a5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5292-83-0x00007FFA20860000-0x00007FFA2091E000-memory.dmp

memory/5292-82-0x00007FFA217B0000-0x00007FFA219A5000-memory.dmp

memory/4272-90-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

memory/5292-81-0x0000000140000000-0x000000014002B000-memory.dmp

memory/5292-79-0x0000000140000000-0x000000014002B000-memory.dmp

memory/5292-78-0x0000000140000000-0x000000014002B000-memory.dmp

memory/5292-77-0x0000000140000000-0x000000014002B000-memory.dmp

memory/1068-135-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/1068-134-0x000001CC75C60000-0x000001CC75C8B000-memory.dmp

memory/1052-132-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/1052-131-0x000001DB579B0000-0x000001DB579DB000-memory.dmp

memory/1036-129-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/1036-128-0x000001F92B2F0000-0x000001F92B31B000-memory.dmp

memory/528-121-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/528-120-0x00000276573B0000-0x00000276573DB000-memory.dmp

memory/960-117-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/960-116-0x0000024D3B1F0000-0x0000024D3B21B000-memory.dmp

memory/64-114-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/64-113-0x000002042B900000-0x000002042B92B000-memory.dmp

memory/636-110-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/636-109-0x0000020FAE220000-0x0000020FAE24B000-memory.dmp

memory/688-106-0x00007FF9E1830000-0x00007FF9E1840000-memory.dmp

memory/688-105-0x000002A25E750000-0x000002A25E77B000-memory.dmp

memory/636-103-0x0000020FAE1F0000-0x0000020FAE214000-memory.dmp

memory/5292-100-0x0000000140000000-0x000000014002B000-memory.dmp

memory/5292-76-0x0000000140000000-0x000000014002B000-memory.dmp

memory/5568-383-0x00000246FEA70000-0x00000246FEA8C000-memory.dmp

memory/5568-384-0x00000246FEA90000-0x00000246FEB45000-memory.dmp

memory/5568-385-0x00000246FEB50000-0x00000246FEB5A000-memory.dmp

memory/5568-386-0x00000246FECC0000-0x00000246FECDC000-memory.dmp

memory/5568-389-0x00000246FECA0000-0x00000246FECAA000-memory.dmp

memory/5568-390-0x00000246FED00000-0x00000246FED1A000-memory.dmp

memory/5568-391-0x00000246FECB0000-0x00000246FECB8000-memory.dmp

memory/5568-392-0x00000246FECE0000-0x00000246FECE6000-memory.dmp

memory/5568-393-0x00000246FECF0000-0x00000246FECFA000-memory.dmp

memory/4272-672-0x00007FFA03793000-0x00007FFA03795000-memory.dmp

memory/5380-682-0x0000000000900000-0x0000000000916000-memory.dmp

memory/4272-683-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fgksno.exe

MD5 ee25fe052ea3b5b96ec28175d35192b4
SHA1 4bab70cef82b9132104bbbd60758debff5eb4492
SHA256 74e4938f2316f8e55e906096527defb3def39160890c7d81f59f7d29bb179589
SHA512 a20bcad2a5aba95268c2253a23e194480e5ba477586d57e74a9411b1ced05c81782c61e5748451813526f83fc809616079f39b4fd187d6ff0329ac0fdb09958b

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CF0.tmp.csv

MD5 63369c92f7bd961be3702706e1524db0
SHA1 10e91c5b5501e838881290a371bea16ac9acd482
SHA256 d868b5a731987e2561a85f8d22b9ed26e76db63836ffd46ab4e264ac868301cc
SHA512 44dcc1da5cd81c9d5569128d8fa7b3702ad0ecf2cdf1d16be8d0d8bfa819dc280250d1523791e7783a4dc07e11c037cbb45e424d0967ffc00d134394c6ad2362

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D20.tmp.txt

MD5 4f8d233df0bbe5fbb40b1e702488522a
SHA1 06d6c6e8636af293512fed8f3bf22c35fb7519bb
SHA256 e4c6b89d217aaed52ba46e45ddb7741ba730f0e7293d1a47e5556c3e835dca8f
SHA512 4b25103d402189dc5e5a7be1560dc9bcd19b446527d95963241cb1237020a879d367708786c83b3da8325cc13ee8d08783917229f2acd03d2fca6294b390db56

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AMD Graphics Manager.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/3456-764-0x0000000000E80000-0x0000000000E96000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win10v2004-20240426-en

Max time kernel

107s

Max time network

139s

Command Line

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\license.txt"

Signatures

N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\license.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win7-20240508-en

Max time kernel

122s

Max time network

130s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\resources.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\resources.js"

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

152s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\resources.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\resources.js"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\ByfronHook.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Release\ByfronHook.js"

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\instructions.txt"

Signatures

N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\instructions.txt"

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

149s

Command Line

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\instructions.txt"

Signatures

N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\instructions.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-01 04:18

Reported

2024-06-01 04:21

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\license.txt"

Signatures

N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Lunar Release\license.txt"

Network

N/A

Files

N/A