Malware Analysis Report

2024-10-10 08:35

Sample ID 240618-sqgneatcnq
Target loader.exe
SHA256 f967660afa6c074af705058bd0e681c5a431e705b83149c6e54f5b04797ded19
Tags
pyinstaller blankgrabber execution upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f967660afa6c074af705058bd0e681c5a431e705b83149c6e54f5b04797ded19

Threat Level: Known bad

The file loader.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller blankgrabber execution upx

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

UPX packed file

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

Detects Pyinstaller

Suspicious use of WriteProcessMemory

Modifies registry class

Enumerates processes with tasklist

Detects videocard installed

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-18 15:19

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 15:19

Reported

2024-06-18 15:22

Platform

win7-20240611-en

Max time kernel

121s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.pyc C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.pyc\ = "pyc_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pyc_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pyc_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pyc_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pyc_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pyc_auto_file C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\loader-o.pyc

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\loader-o.pyc"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 aa337c14dd128bf374565eb951a962b0
SHA1 1e482203f1a609169afc0a0e88bc803439f5efe4
SHA256 a8b9e08dcae9dd0cbfd68ce7c19bba81645d7ded76d8f9355334bd627715d2bb
SHA512 503b41fc47e7b9e6229691a384868e9040f4d52b1adf373bde669b57c127980ce3f657d1b00495c0f8ffed276e8a6ff5f73b42c0a15afa6685d5fa4cdb7cd94b

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-18 15:19

Reported

2024-06-18 15:22

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 15:19

Reported

2024-06-18 15:19

Platform

win7-20240221-en

Max time kernel

0s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 15:19

Reported

2024-06-18 15:22

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3988 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Users\Admin\AppData\Local\Temp\loader.exe
PID 3988 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Users\Admin\AppData\Local\Temp\loader.exe
PID 3092 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 820 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 820 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3088 wrote to memory of 4496 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3088 wrote to memory of 4496 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4408 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4408 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3092 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 4460 wrote to memory of 3872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4460 wrote to memory of 3872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3092 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2292 wrote to memory of 3096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2292 wrote to memory of 3096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3092 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3332 wrote to memory of 1884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3332 wrote to memory of 1884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3092 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3092 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2280 wrote to memory of 1176 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2280 wrote to memory of 1176 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3092 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3092 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍‍‎  .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍‍‎  .scr'

Network

Country Destination Domain Proto
US 8.8.8.8:53 blank-q2key.in udp
US 8.8.8.8:53 blank-q2key.in udp
US 8.8.8.8:53 blank-q2key.in udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI39882\python312.dll

MD5 fb8bedf8440eb432c9f3587b8114abc0
SHA1 136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256 cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512 b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

C:\Users\Admin\AppData\Local\Temp\_MEI39882\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/3092-25-0x00007FF8AF460000-0x00007FF8AFB25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39882\base_library.zip

MD5 8dad91add129dca41dd17a332a64d593
SHA1 70a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
SHA512 2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_ctypes.pyd

MD5 a8cb7698a8282defd6143536ed821ec9
SHA1 3d1b476b9c042d066de16308d99f1633393a497a
SHA256 40d53a382a78b305064a4f4df50543d2227679313030c9edf5ee82af23bf8f4a
SHA512 1445ae7dc7146afbe391e131baff456445d7e96a3618bfef36dc39af978dd305e3a294acd62ee91a050812c321a9ec298085c7ad4eb9b81e2e40e23c5a85f2cc

C:\Users\Admin\AppData\Local\Temp\_MEI39882\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_ssl.pyd

MD5 615bfc3800cf4080bc6d52ac091ec925
SHA1 5b661997ed1f0a6ea22640b11af71e0655522a10
SHA256 1819dd90e26aa49eb40119b6442e0e60ec95d3025e9c863778dcc6295a2b561f
SHA512 1198426b560044c7f58b1a366a9f8afcde1b6e45647f9ae9c451fb121708aa4371673815be1d35ad1015029c7c1c6ea4755eb3701dbf6f3f65078a18a1daeacb

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_sqlite3.pyd

MD5 3d85e2aa598468d9449689a89816395e
SHA1 e6d01b535c8fc43337f3c56bfc0678a64cf89151
SHA256 6f0c212cb7863099a7ce566a5cf83880d91e38a164dd7f9d05d83cce80fa1083
SHA512 a9a527fc1fcce3ffe95e9e6f4991b1a7156a5ca35181100ea2a25b42838b91e39dd9f06f0efedb2453aa87f90e134467a7662dbbe22c6771f1204d82cc6cea82

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_socket.pyd

MD5 f8d03997e7efcdd28a351b6f35b429a2
SHA1 1a7ae96f258547a14f6e8c0defe127a4e445206d
SHA256 aef190652d8466c0455311f320248764acbff6109d1238a26f8983ce86483bf1
SHA512 40c9bce421c7733df37558f48b8a95831cc3cf3e2c2cdf40477b733b14bd0a8a0202bc8bc95f39fcd2f76d21deac21ad1a4d0f6218b8f8d57290968163effef8

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_queue.pyd

MD5 fc796fcde996f78225a4ec1bed603606
SHA1 5389f530aaf4bd0d4fce981f57f68a67fe921ee1
SHA256 c7c598121b1d82eb710425c0dc1fc0598545a61ffb1dd41931bb9368fb350b93
SHA512 4d40e5a4ab266646bedacf4fde9674a14795dcfb72aae70a1c4c749f7a9a4f6e302a00753fe0446c1d7cc90caee2d37611d398fdc4c68e48c8bc3637dfd57c15

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_lzma.pyd

MD5 05adb189d4cfdcacb799178081d8ebcb
SHA1 657382ad2c02b42499e399bfb7be4706343cecab
SHA256 87b7bae6b4f22d7d161aefae54bc523d9c976ea2aef17ee9c3cf8fe958487618
SHA512 13fc9204d6f16a6b815addf95c31ea5c543bf8608bfcc5d222c7075dd789551a202ae442fddc92ea5919ecf58ba91383a0f499182b330b98b240152e3aa868c5

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_hashlib.pyd

MD5 89f3c173f4ca120d643aab73980ade66
SHA1 e4038384b64985a978a6e53142324a7498285ec4
SHA256 95b1f5eff9d29eb6e7c6ed817a12ca33b67c76acea3cb4f677ec1e6812b28b67
SHA512 76e737552be1ce21b92fa291777eac2667f2cfc61ae5eb62d133c89b769a8d4ef8082384b5c819404b89a698fcc1491c62493cf8ff0dcc65e01f96b6f7b5e14f

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_decimal.pyd

MD5 ccfad3c08b9887e6cea26ddca2b90b73
SHA1 0e0fb641b386d57f87e69457faf22da259556a0d
SHA256 bad3948151d79b16776db9a4a054033a6f2865cb065f53a623434c6b5c9f4aad
SHA512 3af88779db58dcae4474c313b7d55f181f0678c24c16240e3b03721b18b66bdfb4e18d73a3cef0c954d0b8e671cf667fc5e91b5f1027de489a7039b39542b8ca

C:\Users\Admin\AppData\Local\Temp\_MEI39882\_bz2.pyd

MD5 980eff7e635ad373ecc39885a03fbdc3
SHA1 9a3e9b13b6f32b207b065f5fcf140aecfd11b691
SHA256 b4411706afc8b40a25e638a59fe1789fa87e1ce54109ba7b5bd84c09c86804e1
SHA512 241f9d3e25e219c7b9d12784ab525ab5ded58ca623bc950027b271c8dfb7c19e13536f0caf937702f767413a6d775bed41b06902b778e4bad2946917e16ad4ef

C:\Users\Admin\AppData\Local\Temp\_MEI39882\unicodedata.pyd

MD5 27b3af74ddaf9bca239bf2503bf7e45b
SHA1 80a09257f9a4212e2765d492366ed1e60d409e04
SHA256 584c2ecea23dfc72ab793b3fd1059b3ea6fdf885291a3c7a166157cf0e6491c4
SHA512 329c3a9159ea2fdce5e7a28070bcf9d6d67eca0b27c4564e5250e7a407c8b551b68a034bfde9d8d688fa5a1ae6e29e132497b3a630796a97b464762ca0d81bb7

C:\Users\Admin\AppData\Local\Temp\_MEI39882\sqlite3.dll

MD5 482b3f8adf64f96ad4c81ae3e7c0fb35
SHA1 91891d0eabb33211970608f07850720bd8c44734
SHA256 1fbdb4020352e18748434ef6f86b7346f48d6fb9a72c853be7b05e0e53ebbb03
SHA512 5de56e00ab6f48ffc836471421d4e360d913a78ee8e071896a2cd951ff20f7a4123abd98adf003ce166dcc82aad248ebf8b63e55e14eceec8aa9a030067c0d1d

C:\Users\Admin\AppData\Local\Temp\_MEI39882\select.pyd

MD5 08b4caeaccb6f6d27250e6a268c723be
SHA1 575c11f72c8d0a025c307cb12efa5cb06705561d
SHA256 bd853435608486555091146ab34b71a9247f4aaa9f7ecfbc3b728a3e3efde436
SHA512 9b525395dec028ef3286c75b88f768e5d40195d4d5adab0775c64b623345d81da1566596cc61a460681bc0adba9727afc96c98ad2e54ff371919f3db6d369b0c

C:\Users\Admin\AppData\Local\Temp\_MEI39882\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI39882\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI39882\libssl-3.dll

MD5 264be59ff04e5dcd1d020f16aab3c8cb
SHA1 2d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA512 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

C:\Users\Admin\AppData\Local\Temp\_MEI39882\libcrypto-3.dll

MD5 7f1b899d2015164ab951d04ebb91e9ac
SHA1 1223986c8a1cbb57ef1725175986e15018cc9eab
SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512 ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

C:\Users\Admin\AppData\Local\Temp\_MEI39882\blank.aes

MD5 ce352854f6dedcde500f7b988d463be0
SHA1 239f5a1e64c8b1b9e156c5fbf21482afad6f034a
SHA256 f2a63f6152b04ff8b28ef5d8461931bf68b9a4864b957227156205fd5cf94b04
SHA512 58783c781a71831f3f4eda668959b6d68254322ba0bfaaa1757f200bdfa98c2419830e63aaaa2a83fa9bbf70a7110055eadfe1bad8c2d7ea790fd85e57e34531

memory/3092-32-0x00007FF8C3B80000-0x00007FF8C3B8F000-memory.dmp

memory/3092-31-0x00007FF8C25E0000-0x00007FF8C2605000-memory.dmp

memory/3092-54-0x00007FF8BED70000-0x00007FF8BED9D000-memory.dmp

memory/3092-56-0x00007FF8C2560000-0x00007FF8C257A000-memory.dmp

memory/3092-58-0x00007FF8BED40000-0x00007FF8BED64000-memory.dmp

memory/3092-60-0x00007FF8AED20000-0x00007FF8AEE9E000-memory.dmp

memory/3092-64-0x00007FF8C3B70000-0x00007FF8C3B7D000-memory.dmp

memory/3092-63-0x00007FF8BF520000-0x00007FF8BF539000-memory.dmp

memory/3092-66-0x00007FF8BEA80000-0x00007FF8BEAB3000-memory.dmp

memory/3092-71-0x00007FF8BE860000-0x00007FF8BE92D000-memory.dmp

memory/3092-72-0x0000023FCAC50000-0x0000023FCB179000-memory.dmp

memory/3092-73-0x00007FF8AE7F0000-0x00007FF8AED19000-memory.dmp

memory/3092-76-0x00007FF8C25E0000-0x00007FF8C2605000-memory.dmp

memory/3092-80-0x00007FF8AE6D0000-0x00007FF8AE7EB000-memory.dmp

memory/3092-78-0x00007FF8C3180000-0x00007FF8C318D000-memory.dmp

memory/3092-77-0x00007FF8BEC00000-0x00007FF8BEC14000-memory.dmp

memory/3092-70-0x00007FF8AF460000-0x00007FF8AFB25000-memory.dmp

memory/892-81-0x00007FF8ADC03000-0x00007FF8ADC05000-memory.dmp

memory/3092-82-0x00007FF8BED40000-0x00007FF8BED64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2nrq41w5.iow.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/892-97-0x000001BEEEA10000-0x000001BEEEA32000-memory.dmp

memory/892-102-0x00007FF8ADC00000-0x00007FF8AE6C1000-memory.dmp

memory/892-103-0x00007FF8ADC00000-0x00007FF8AE6C1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

memory/892-109-0x00007FF8ADC00000-0x00007FF8AE6C1000-memory.dmp

memory/3092-110-0x00007FF8AED20000-0x00007FF8AEE9E000-memory.dmp

memory/3092-125-0x00007FF8AE6D0000-0x00007FF8AE7EB000-memory.dmp

memory/3092-122-0x00007FF8AE7F0000-0x00007FF8AED19000-memory.dmp

memory/3092-121-0x00007FF8BE860000-0x00007FF8BE92D000-memory.dmp

memory/3092-111-0x00007FF8AF460000-0x00007FF8AFB25000-memory.dmp

memory/3092-120-0x00007FF8BEA80000-0x00007FF8BEAB3000-memory.dmp

memory/3092-126-0x0000023FCAC50000-0x0000023FCB179000-memory.dmp

memory/3092-127-0x00007FF8AF460000-0x00007FF8AFB25000-memory.dmp

memory/3092-156-0x00007FF8AF460000-0x00007FF8AFB25000-memory.dmp

memory/3092-171-0x00007FF8AF460000-0x00007FF8AFB25000-memory.dmp