Analysis
-
max time kernel
87s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 02:52
Static task
static1
Behavioral task
behavioral1
Sample
sigmahaks.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
sigmahaks.exe
Resource
win10v2004-20240508-en
General
-
Target
sigmahaks.exe
-
Size
3.2MB
-
MD5
e0621270ac0900d68fef321c7efb36cb
-
SHA1
06693f38735d3fc84739f75998d921ee579db1fd
-
SHA256
a8d2e1e4a318733fa0f741f82a2bd30f2dd8db6099f502c986b1d7cfdde83c46
-
SHA512
e9bb6f73ae8b139994d840d8254e2a820d0eb957bb6408d2a22b5cdf1770b5fe66718ee1aaa2237fd89adfff8bfdc6899349f154a81c7924039a124bf1648b09
-
SSDEEP
49152:yvZ6r25iapTY4PslEsvRnLVd4NJT83bRAQoGdiTHHB72eh2NT:yvMr25iapTY4PslEsvlLVd4NJT87
Malware Config
Extracted
quasar
1.4.1
It was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mindIt was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No t
idk:4782
5c7d6a36-dffc-4ec3-8525-ba9161772945
-
encryption_key
7930C3883BFB3E417BEC9036B64E581CD2465EFE
-
install_name
Byfron.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Balls
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4308-1-0x0000000000700000-0x0000000000A38000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe family_quasar -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Byfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Byfron.exe -
Executes dropped EXE 8 IoCs
Processes:
Byfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exepid process 3132 Byfron.exe 2084 Byfron.exe 1992 Byfron.exe 544 Byfron.exe 3188 Byfron.exe 840 Byfron.exe 4960 Byfron.exe 3232 Byfron.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4756 schtasks.exe 4788 schtasks.exe 4540 schtasks.exe 3660 schtasks.exe 2432 schtasks.exe 2364 schtasks.exe 2044 schtasks.exe 1396 schtasks.exe 1988 schtasks.exe -
Runs ping.exe 1 TTPs 7 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 4860 PING.EXE 3300 PING.EXE 3464 PING.EXE 4420 PING.EXE 1644 PING.EXE 968 PING.EXE 4280 PING.EXE -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
sigmahaks.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exedescription pid process Token: SeDebugPrivilege 4308 sigmahaks.exe Token: SeDebugPrivilege 3132 Byfron.exe Token: SeDebugPrivilege 2084 Byfron.exe Token: SeDebugPrivilege 1992 Byfron.exe Token: SeDebugPrivilege 544 Byfron.exe Token: SeDebugPrivilege 3188 Byfron.exe Token: SeDebugPrivilege 840 Byfron.exe Token: SeDebugPrivilege 4960 Byfron.exe Token: SeDebugPrivilege 3232 Byfron.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
Byfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exeByfron.exepid process 3132 Byfron.exe 2084 Byfron.exe 1992 Byfron.exe 544 Byfron.exe 3188 Byfron.exe 840 Byfron.exe 4960 Byfron.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
sigmahaks.exeByfron.execmd.exeByfron.execmd.exeByfron.execmd.exeByfron.execmd.exeByfron.execmd.exeByfron.execmd.exedescription pid process target process PID 4308 wrote to memory of 4756 4308 sigmahaks.exe schtasks.exe PID 4308 wrote to memory of 4756 4308 sigmahaks.exe schtasks.exe PID 4308 wrote to memory of 3132 4308 sigmahaks.exe Byfron.exe PID 4308 wrote to memory of 3132 4308 sigmahaks.exe Byfron.exe PID 3132 wrote to memory of 2364 3132 Byfron.exe schtasks.exe PID 3132 wrote to memory of 2364 3132 Byfron.exe schtasks.exe PID 3132 wrote to memory of 4620 3132 Byfron.exe cmd.exe PID 3132 wrote to memory of 4620 3132 Byfron.exe cmd.exe PID 4620 wrote to memory of 3592 4620 cmd.exe chcp.com PID 4620 wrote to memory of 3592 4620 cmd.exe chcp.com PID 4620 wrote to memory of 3300 4620 cmd.exe PING.EXE PID 4620 wrote to memory of 3300 4620 cmd.exe PING.EXE PID 4620 wrote to memory of 2084 4620 cmd.exe Byfron.exe PID 4620 wrote to memory of 2084 4620 cmd.exe Byfron.exe PID 2084 wrote to memory of 4788 2084 Byfron.exe schtasks.exe PID 2084 wrote to memory of 4788 2084 Byfron.exe schtasks.exe PID 2084 wrote to memory of 2592 2084 Byfron.exe cmd.exe PID 2084 wrote to memory of 2592 2084 Byfron.exe cmd.exe PID 2592 wrote to memory of 2560 2592 cmd.exe chcp.com PID 2592 wrote to memory of 2560 2592 cmd.exe chcp.com PID 2592 wrote to memory of 3464 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 3464 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 1992 2592 cmd.exe Byfron.exe PID 2592 wrote to memory of 1992 2592 cmd.exe Byfron.exe PID 1992 wrote to memory of 4540 1992 Byfron.exe schtasks.exe PID 1992 wrote to memory of 4540 1992 Byfron.exe schtasks.exe PID 1992 wrote to memory of 372 1992 Byfron.exe cmd.exe PID 1992 wrote to memory of 372 1992 Byfron.exe cmd.exe PID 372 wrote to memory of 1000 372 cmd.exe chcp.com PID 372 wrote to memory of 1000 372 cmd.exe chcp.com PID 372 wrote to memory of 4420 372 cmd.exe PING.EXE PID 372 wrote to memory of 4420 372 cmd.exe PING.EXE PID 372 wrote to memory of 544 372 cmd.exe Byfron.exe PID 372 wrote to memory of 544 372 cmd.exe Byfron.exe PID 544 wrote to memory of 2044 544 Byfron.exe schtasks.exe PID 544 wrote to memory of 2044 544 Byfron.exe schtasks.exe PID 544 wrote to memory of 5076 544 Byfron.exe cmd.exe PID 544 wrote to memory of 5076 544 Byfron.exe cmd.exe PID 5076 wrote to memory of 2188 5076 cmd.exe chcp.com PID 5076 wrote to memory of 2188 5076 cmd.exe chcp.com PID 5076 wrote to memory of 1644 5076 cmd.exe PING.EXE PID 5076 wrote to memory of 1644 5076 cmd.exe PING.EXE PID 5076 wrote to memory of 3188 5076 cmd.exe Byfron.exe PID 5076 wrote to memory of 3188 5076 cmd.exe Byfron.exe PID 3188 wrote to memory of 1396 3188 Byfron.exe schtasks.exe PID 3188 wrote to memory of 1396 3188 Byfron.exe schtasks.exe PID 3188 wrote to memory of 4928 3188 Byfron.exe cmd.exe PID 3188 wrote to memory of 4928 3188 Byfron.exe cmd.exe PID 4928 wrote to memory of 2052 4928 cmd.exe chcp.com PID 4928 wrote to memory of 2052 4928 cmd.exe chcp.com PID 4928 wrote to memory of 968 4928 cmd.exe PING.EXE PID 4928 wrote to memory of 968 4928 cmd.exe PING.EXE PID 4928 wrote to memory of 840 4928 cmd.exe Byfron.exe PID 4928 wrote to memory of 840 4928 cmd.exe Byfron.exe PID 840 wrote to memory of 1988 840 Byfron.exe schtasks.exe PID 840 wrote to memory of 1988 840 Byfron.exe schtasks.exe PID 840 wrote to memory of 4312 840 Byfron.exe cmd.exe PID 840 wrote to memory of 4312 840 Byfron.exe cmd.exe PID 4312 wrote to memory of 1704 4312 cmd.exe chcp.com PID 4312 wrote to memory of 1704 4312 cmd.exe chcp.com PID 4312 wrote to memory of 4280 4312 cmd.exe PING.EXE PID 4312 wrote to memory of 4280 4312 cmd.exe PING.EXE PID 4312 wrote to memory of 4960 4312 cmd.exe Byfron.exe PID 4312 wrote to memory of 4960 4312 cmd.exe Byfron.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmahaks.exe"C:\Users\Admin\AppData\Local\Temp\sigmahaks.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BXzbz87O0usw.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\suabXe5Z8BIL.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f7⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2H2xLijVD5M3.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f9⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J2QDinhsmiXv.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f11⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k2VGXAAApmgr.bat" "11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f13⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N21v02g1b0y0.bat" "13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f15⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6nHqCsf077mM.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Balls" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exe" /rl HIGHEST /f17⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Byfron.exe.logFilesize
2KB
MD58f0271a63446aef01cf2bfc7b7c7976b
SHA1b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA256da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
SHA51278a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
-
C:\Users\Admin\AppData\Local\Temp\2H2xLijVD5M3.batFilesize
207B
MD59486eb829978a76d810c40060832072c
SHA11df5e178ecb9996f994d1eba7f28ed6c9a2e9965
SHA2560298c91fd1881ec5c6441c47118744ded612152fb753fa332c567ec672dc5110
SHA512090b3d4fc9002160c46c5e95dbb64df6d27c5670485054cee8a680acd4685f45c9b98c14ac5dc76001179420d43679f521996d40efe8e7259b7dbf75d3a11e7e
-
C:\Users\Admin\AppData\Local\Temp\6nHqCsf077mM.batFilesize
207B
MD558603c9f65bb3c1e19aa7a5006555abd
SHA1d886f422db77c9320d0394a987704ed19ee04584
SHA2567a205dc26a0382e7de0d7deb109cf98c311820ba1ceddd0773feba71903a1464
SHA512ac84c1501bfc395aa1ddf8e3250f08668de8866800604ee5aa529a2a7598f8d179ca95eba9168fb3318247afe78be663da96a75eb02fcac5ae39ad32e5c63994
-
C:\Users\Admin\AppData\Local\Temp\BXzbz87O0usw.batFilesize
207B
MD5ef6d452e5c140457f5a6d70ca6aa86bb
SHA12b0fd99d33628b44067374f431a6c2a63b121c53
SHA256f414d7ae1ea38418e167cfe6ac85510d5f63d255223e949f1797d3c352501273
SHA512080df28aafd2d54c3b37ef45a7d6609bfa21c634336e72c6b62b9e8fda4f4cf431beef1262ec02ea51a9642412f51c8e109cb2a60b93e1d3ad7b434ce9868f44
-
C:\Users\Admin\AppData\Local\Temp\J2QDinhsmiXv.batFilesize
207B
MD598e897e263c053452127710c33088dba
SHA1b340dd9b6f2bcbe35c37f877fe719004face2a43
SHA2564ad1c5e4fc4296b4791a1da5ff2d8793dacaa9ab6b66ddc37ed7acbc51a46f25
SHA5125649de7fdccaa795ca0c912ace1e09c5a0d61d0fd628a846c09fb7a903fbca95a2d418e395e46702b8e7b7e9acd14c058c2dec6b6dd84e33406ed03b866fa6de
-
C:\Users\Admin\AppData\Local\Temp\N21v02g1b0y0.batFilesize
207B
MD5d8b5c6c00ad9426e138182f86ced2d43
SHA18d095c3c3a798b946a7779f0cf5cbc394b4c2e16
SHA2569db8562820eb3ba9eed5ccb47db1a70d60434c8684c1faf832ca439892a67644
SHA512ff022cd5a41d1c7d23bce9d92d9adebcbaa4d2f6d221b1f4634f13c69580b1223bd61c6b94aa4c9787a42dba50f953181be79b9cb642c0f13d9934d3ac85c719
-
C:\Users\Admin\AppData\Local\Temp\k2VGXAAApmgr.batFilesize
207B
MD506a55b43e303dbeba5c2e3357c23e9a5
SHA1e718a7685ad691f65aaf52bc3c5ddc626a79e398
SHA256cf237fe4777538a177148492c37e0a0d140437d12684681dbc3f3b40e202e31e
SHA5124da5b78e8a7f57d9be57f1fbeeacf9f7631a2f1cd0d2b9749467b566fac449a74c3d58e9b7ffaff2d41238b2c2180ee316a8827a2a1936f922a956dd311323eb
-
C:\Users\Admin\AppData\Local\Temp\suabXe5Z8BIL.batFilesize
207B
MD501f004b702ec0d5e00522fa0edd9b3f2
SHA1494e3dbfc0a6463b1e96d299ef3334eb4b063b9d
SHA256ac48fdc9572b2d0bfcd90d728751eee6df3d21cd1c8b6ce2be24060b54b55825
SHA512cfd9f64d8696da17c67c7a3eedd1649dcb17682f6050fa52c3a706dd63f1476fa37d69dbee6c378ce6628b5682a447e46c5d43bc9dee6686ec9a233ef3c3167a
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exeFilesize
2.3MB
MD53416e1792f0297cfb12ee812dd98ef78
SHA1959ca49711f7294a447e839e1ba24b7ada871dbd
SHA2562aa8ebfd1d6e2ef14d65965af8e81d0a98a63774c01d7c5d0be57461f5b0eb7a
SHA5123e9c47a829f8ce2663e4a9420458de4cbc2540afcfd0d33a87af60dad729d609c2f76d8bcd57e3eab9ccc0efa0159c24d69809662d59d06c1895e75a387cc8b8
-
C:\Users\Admin\AppData\Roaming\SubDir\Byfron.exeFilesize
3.2MB
MD5e0621270ac0900d68fef321c7efb36cb
SHA106693f38735d3fc84739f75998d921ee579db1fd
SHA256a8d2e1e4a318733fa0f741f82a2bd30f2dd8db6099f502c986b1d7cfdde83c46
SHA512e9bb6f73ae8b139994d840d8254e2a820d0eb957bb6408d2a22b5cdf1770b5fe66718ee1aaa2237fd89adfff8bfdc6899349f154a81c7924039a124bf1648b09
-
memory/3132-13-0x000000001C5C0000-0x000000001C672000-memory.dmpFilesize
712KB
-
memory/3132-19-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/3132-12-0x000000001C4B0000-0x000000001C500000-memory.dmpFilesize
320KB
-
memory/3132-11-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/3132-10-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/4308-0-0x00007FF9A8013000-0x00007FF9A8015000-memory.dmpFilesize
8KB
-
memory/4308-9-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/4308-2-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/4308-1-0x0000000000700000-0x0000000000A38000-memory.dmpFilesize
3.2MB