Malware Analysis Report

2025-04-03 19:53

Sample ID 241109-wtmwdaslbq
Target 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N
SHA256 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4
Tags
discovery evasion persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4

Threat Level: Known bad

The file 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence upx

Modifies firewall policy service

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 18:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 18:12

Reported

2024-11-09 18:14

Platform

win7-20241010-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2724 set thread context of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 set thread context of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 3012 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3012 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3012 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3012 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2372 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2372 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2372 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2372 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2724 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2452 wrote to memory of 596 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 596 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 596 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 596 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 332 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 332 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 332 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 332 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 332 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 332 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 332 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 332 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 596 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 596 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 596 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 596 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 484 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 484 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 484 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 484 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 600 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 600 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 600 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 600 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe

"C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ucLqK.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f

C:\Users\Admin\AppData\Roaming\winlogon.exe

"C:\Users\Admin\AppData\Roaming\winlogon.exe"

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/2372-0-0x0000000000400000-0x000000000058A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ucLqK.bat

MD5 4da6717f2c70f4bd32ad33a227a2ff47
SHA1 3d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256 a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA512 6765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df

C:\Users\Admin\AppData\Roaming\winlogon.exe

MD5 8de9f42a930f36a73c094129afc809b6
SHA1 7c83e7e552b56b1a4638638817aa87b33932f411
SHA256 8c7ffde7f1ba5d4204100a202caf67cbd5eb7943a859fbc25a587be36c7b4a06
SHA512 ef07819b97addcec3d7cbec003d2f60e69d0de7079e87959f3b17b2fff2d20facc47d61384ea45f021ca09fdb97bc74487118f5df390959afc8508f169bc494f

memory/2452-53-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2452-60-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2452-59-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2784-56-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2452-52-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2452-51-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2784-64-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2784-68-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2784-65-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2452-69-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2784-70-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2452-71-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2452-73-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2452-76-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2452-78-0x0000000000400000-0x000000000045D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 18:12

Reported

2024-11-09 18:14

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1940 set thread context of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 set thread context of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1200 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Windows\SysWOW64\cmd.exe
PID 4728 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4728 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4728 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1200 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1200 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1200 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 1940 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 3372 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 776 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 776 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 776 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 224 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 224 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 224 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 1348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3628 wrote to memory of 1348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3628 wrote to memory of 1348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 224 wrote to memory of 3272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 224 wrote to memory of 3272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 224 wrote to memory of 3272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3344 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3344 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3344 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 776 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 776 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 776 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe

"C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\polkd.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f

C:\Users\Admin\AppData\Roaming\winlogon.exe

"C:\Users\Admin\AppData\Roaming\winlogon.exe"

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/1200-0-0x0000000000400000-0x000000000058A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\polkd.txt

MD5 4da6717f2c70f4bd32ad33a227a2ff47
SHA1 3d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256 a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA512 6765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df

C:\Users\Admin\AppData\Roaming\winlogon.txt

MD5 97418670499522076ec69f6637663235
SHA1 a8bbcec670be38f2fa4558bef01a023ccfe176cb
SHA256 e3707b944599eea1a90b68f6af2abdc1cce0b1f17264cffc3cfdc0b0334bc348
SHA512 9eff887f8120cefc6dcfc1b8514c321fc334e05e995e6555d07147fcc8c4958fa47f9ebd87d6d4deb7ba8c57fd0f2092ef83ee80f59c8ebf02be7f3dd289c4a3

memory/3372-31-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-35-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-36-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-34-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4572-49-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4572-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4572-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4572-42-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3372-50-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-51-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-53-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-56-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-58-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3372-74-0x0000000000400000-0x000000000045D000-memory.dmp