Analysis Overview
SHA256
01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94
Threat Level: Known bad
The file 01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N was found to be: Known bad.
Malicious Activity Summary
Banload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Executes dropped EXE
Loads dropped DLL
Checks BIOS information in registry
Adds Run key to start application
Enumerates physical storage devices
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-02 16:47
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-02 16:47
Reported
2024-10-02 16:49
Platform
win7-20240903-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
Banload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\fxnkj.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\fxnkj.exe" | C:\ProgramData\fxnkj.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\ProgramData\fxnkj.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC} | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\ = "IntDitherer Class" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ = "C:\\Windows\\SysWOW64\\mshtml.dll" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ThreadingModel = "Apartment" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 33 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2172 wrote to memory of 2792 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\fxnkj.exe |
| PID 2172 wrote to memory of 2792 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\fxnkj.exe |
| PID 2172 wrote to memory of 2792 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\fxnkj.exe |
| PID 2172 wrote to memory of 2792 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\fxnkj.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe
"C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe"
C:\ProgramData\fxnkj.exe
"C:\ProgramData\fxnkj.exe"
Network
Files
memory/2172-0-0x0000000000400000-0x000000000069E000-memory.dmp
memory/2172-1-0x0000000003230000-0x000000000343C000-memory.dmp
memory/2172-8-0x0000000003230000-0x000000000343C000-memory.dmp
memory/2172-11-0x0000000000400000-0x000000000069E000-memory.dmp
memory/2172-13-0x0000000000400000-0x000000000069E000-memory.dmp
memory/2172-12-0x0000000000400000-0x000000000069E000-memory.dmp
memory/2172-14-0x0000000003230000-0x000000000343C000-memory.dmp
memory/2172-15-0x0000000003230000-0x000000000343C000-memory.dmp
\ProgramData\fxnkj.exe
| MD5 | 185fcf13769319736d9783307db804c7 |
| SHA1 | 38b2cf70afebe2b9f791b958768e922904494743 |
| SHA256 | ef0981846d70079887547094e95d170137397ceab0ebf1b46e2f1945e1a5b771 |
| SHA512 | e2cc6d3a474f64ee490c6fc4b6b8325e9e588f0a00565334ee91b669ebef536aa657f865f3c3d3d01c70a735c4b0895683573f92c2154cb18eb0eeceb6a668c9 |
C:\ProgramData\Saaaalamm\Mira.h
| MD5 | 6f69f8db5bfe93af6af2529fb4d168d0 |
| SHA1 | 633e46ce9b641fac4c09b83fbb470895acf67885 |
| SHA256 | 64d2a64e120af1965c60964108a5b8b8c4a6a1139db5b07ad990e02a8038e99c |
| SHA512 | a6a899a9f7a448e220476e657e768d56494a01027c0170690faaefce5911c0e6fd916271c84224ffe2fb931ea7d20407ade9f8734a2b6fc076787bec3a504299 |
memory/2172-32-0x0000000003230000-0x000000000343C000-memory.dmp
memory/2172-35-0x0000000003230000-0x000000000343C000-memory.dmp
memory/2172-34-0x0000000000400000-0x000000000069E000-memory.dmp
memory/2792-66-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2792-154-0x0000000000400000-0x0000000000448000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-02 16:47
Reported
2024-10-02 16:49
Platform
win10v2004-20240802-en
Max time kernel
118s
Max time network
102s
Command Line
Signatures
Banload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\hwrlo.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\hwrlo.exe" | C:\ProgramData\hwrlo.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\ProgramData\hwrlo.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\VarType = "3" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\9 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\Key = "URL" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\6 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ThreadingModel = "Apartment" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\Section = "InternetShortcut" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\VarType = "11" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\Key = "URL" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\7 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294} | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\13\VarType = "18" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\10 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\11\Key = "Author" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\Key = "IconIndex" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\9 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\9\VarType = "3" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\10 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\12\Key = "Desc" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\13 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\13\Key = "Comment" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14\VarType = "66" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\5 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\7\Key = "ShowCommand" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046} | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\11 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\12 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14\Key = "IDList" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\6\VarType = "18" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\ = "URL Shortcut PropSetStorage Mapping" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\CLSID = "{942bc614-676c-464e-b384-d3202aaa02da}" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\5\Key = "WorkingDirectory" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\10\Key = "IconFile" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\13 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC} | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\Key = "Roamed" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2 | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\6\Key = "HotKey" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\7\VarType = "3" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\9\Key = "IconFile" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\Section = "InternetShortcut" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\10\Key = "WhatsNew" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\InitPropertyBag | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\13\Key = "HotKey" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\9\Key = "IconIndex" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ = "C:\\Windows\\SysWOW64\\ieframe.dll" | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 33 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3856 wrote to memory of 488 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\hwrlo.exe |
| PID 3856 wrote to memory of 488 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\hwrlo.exe |
| PID 3856 wrote to memory of 488 | N/A | C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe | C:\ProgramData\hwrlo.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe
"C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe"
C:\ProgramData\hwrlo.exe
"C:\ProgramData\hwrlo.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| NL | 52.111.243.29:443 | tcp | |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.209.201.84.in-addr.arpa | udp |
Files
memory/3856-0-0x0000000000400000-0x000000000069E000-memory.dmp
memory/3856-2-0x0000000004E00000-0x000000000500C000-memory.dmp
memory/3856-9-0x0000000004E00000-0x000000000500C000-memory.dmp
memory/3856-12-0x0000000000400000-0x000000000069E000-memory.dmp
memory/3856-13-0x0000000000400000-0x000000000069E000-memory.dmp
memory/3856-14-0x0000000000400000-0x000000000069E000-memory.dmp
memory/3856-15-0x0000000004E00000-0x000000000500C000-memory.dmp
memory/3856-16-0x0000000004E00000-0x000000000500C000-memory.dmp
memory/3856-17-0x0000000004E00000-0x000000000500C000-memory.dmp
C:\ProgramData\hwrlo.exe
| MD5 | 185fcf13769319736d9783307db804c7 |
| SHA1 | 38b2cf70afebe2b9f791b958768e922904494743 |
| SHA256 | ef0981846d70079887547094e95d170137397ceab0ebf1b46e2f1945e1a5b771 |
| SHA512 | e2cc6d3a474f64ee490c6fc4b6b8325e9e588f0a00565334ee91b669ebef536aa657f865f3c3d3d01c70a735c4b0895683573f92c2154cb18eb0eeceb6a668c9 |
C:\ProgramData\Saaaalamm\Mira.h
| MD5 | 24859ed13ca69d29dd5d2b9bf664db03 |
| SHA1 | 23601bfac7e0563832f24f61a3fec531aaa254c5 |
| SHA256 | bae0c12dd74a5621b2d27ac4c3082c964f70e719da5cc2d7cf57e417a7bda0cc |
| SHA512 | b8f0b45970334ee89887e5dfeab2b39d59d078f36d6cf4c01c236f2d3b1a9586f5ac76d4e31d28c410e7b3422ba95fc97f5e42f7093ee7dc5a2d94f3f4216b23 |
memory/3856-30-0x0000000000400000-0x000000000069E000-memory.dmp
memory/3856-31-0x0000000004E00000-0x000000000500C000-memory.dmp
C:\ProgramData\Saaaalamm\Mira.h
| MD5 | 6f69f8db5bfe93af6af2529fb4d168d0 |
| SHA1 | 633e46ce9b641fac4c09b83fbb470895acf67885 |
| SHA256 | 64d2a64e120af1965c60964108a5b8b8c4a6a1139db5b07ad990e02a8038e99c |
| SHA512 | a6a899a9f7a448e220476e657e768d56494a01027c0170690faaefce5911c0e6fd916271c84224ffe2fb931ea7d20407ade9f8734a2b6fc076787bec3a504299 |
memory/3856-25-0x0000000004E00000-0x000000000500C000-memory.dmp
C:\DDF.sys .exe
| MD5 | dc07ff100ce9c8b3239f5a485b559892 |
| SHA1 | 2b985c547dc6656b2776dc541284ee9094de4ddd |
| SHA256 | 93e4083b29e777f3cc9f993134184df270805a482ef92e2ca0bceba5613f80f4 |
| SHA512 | 7125ebe9dd2500f500086a55e487fe2d302d3e5eed92a86e9321a0bd38e6f89e733c0b40f04519ffb9054ceba1aa8452c7051962f5bfa10c321dc83a37717ae1 |
memory/488-54-0x0000000000400000-0x0000000000448000-memory.dmp
memory/488-122-0x0000000000400000-0x0000000000448000-memory.dmp