Malware Analysis Report

2025-05-06 04:20

Sample ID 241109-sz77qaxdjq
Target 2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N
SHA256 2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628
Tags
discovery persistence upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628

Threat Level: Shows suspicious behavior

The file 2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence upx

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 15:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 15:34

Reported

2024-11-09 15:36

Platform

win7-20240903-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindowsWindowsService\\WindowsService.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2532 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 980 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 980 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 980 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 980 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2180 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2180 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2180 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 980 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 980 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 980 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 980 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2476 wrote to memory of 444 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe

"C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe"

C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe

"C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\HDYCP.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsService" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe" /f

C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"

C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"

Network

N/A

Files

memory/2532-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2532-140-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

memory/2532-151-0x0000000001F70000-0x0000000001FF4000-memory.dmp

memory/980-298-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HDYCP.bat

MD5 c2cc427c87f0a6e231266dbb4d5b6ac5
SHA1 e0849fc705f915d218b2dc2f744bb24157022355
SHA256 1b985a6f00b15b5eb13fd2b9c79f163e2c3ed1b8d4133e08f213dc6dc7850999
SHA512 be4d6b172b0c92d1ffa33b30c642db3ccbda637af92234853918ef5e3c6c40121ec10c42557c96ddbc234d0d539c47c6c5adc8bf4c77e9daf8204661215a8e37

\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

MD5 8bf79d0710d6051f67bd3e9a400e7210
SHA1 06bbd0c668da2f88df7fa397cec014f9a4ea4b57
SHA256 58265b56e3429d0981df3ba159dd479de9824a946fb67dabf35ecef512d29573
SHA512 c07078997a1582d163177d167e49b84ecff717a190b0d699db01856ebdf8e641423bca8b550343d71d85e0d71e6c2259b2fba793e1774660027b0bf6ff3dbb85

memory/980-340-0x0000000000400000-0x000000000040B000-memory.dmp

memory/444-612-0x0000000000400000-0x000000000040B000-memory.dmp

memory/980-619-0x0000000000400000-0x000000000040B000-memory.dmp

memory/444-621-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 15:34

Reported

2024-11-09 15:36

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindowsWindowsService\\WindowsService.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 4996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe
PID 2400 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2400 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2400 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 2400 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe
PID 4848 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe

"C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe"

C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe

"C:\Users\Admin\AppData\Local\Temp\2ddb90ba6fcd210c02903afbb47630523d4661d4b0069bfd3386abfbef34e628N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QGCYX.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsService" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe" /f

C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"

C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4996-2-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2400-3-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2400-5-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2400-7-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\QGCYX.txt

MD5 c2cc427c87f0a6e231266dbb4d5b6ac5
SHA1 e0849fc705f915d218b2dc2f744bb24157022355
SHA256 1b985a6f00b15b5eb13fd2b9c79f163e2c3ed1b8d4133e08f213dc6dc7850999
SHA512 be4d6b172b0c92d1ffa33b30c642db3ccbda637af92234853918ef5e3c6c40121ec10c42557c96ddbc234d0d539c47c6c5adc8bf4c77e9daf8204661215a8e37

C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe

MD5 c8f84f6b33d1369e8a7060d4077abf86
SHA1 f78aa729e5f5da2f804f9b233119f8d35fde11a1
SHA256 100ec2156964292c7d67bd47520ce2b3eda5f351bc685831dca8f765c97a1324
SHA512 342f01ee58f841ea9a38050ed4be45be6dcba861396bbdf98acd1dce90c1882c5c309d228128ae7922da55a91a5ac34743410f660a63c07bff50341d9771cd8f

memory/2400-33-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4848-35-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4848-41-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2400-43-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3664-46-0x0000000000400000-0x000000000040B000-memory.dmp