Malware Analysis Report

2024-12-07 10:37

Sample ID 241113-xn9zdsxend
Target a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe
SHA256 a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca
Tags
upx discovery evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca

Threat Level: Known bad

The file a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe was found to be: Known bad.

Malicious Activity Summary

upx discovery evasion persistence

Modifies firewall policy service

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 19:01

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 19:01

Reported

2024-11-13 19:03

Platform

win7-20240729-en

Max time kernel

119s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2744 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2792 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2792 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2792 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2744 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2744 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2744 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2744 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2224 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2224 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2224 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2224 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe

"C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\BivMw.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

"C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp

Files

memory/2744-0-0x0000000000400000-0x00000000005FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BivMw.bat

MD5 130a1ad614bfc1851533b7a02e302622
SHA1 6cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA256 4620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
SHA512 16b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

MD5 e59a520d81bc6cbc62043831691ed31b
SHA1 7d1d508d5d110ecb1fd6099810f2a20e513335fe
SHA256 882fb21cb6cd5941e13fdfad1559319ffebe5eb29da1afcfcad862645dc7bebb
SHA512 a25ca7b32db60f96ee0ae7aa9da31123ed1fb3d9af23dea71ce6a264afa3c4607e56b7dde65ad8a5c3a17fd5a92b164c1f8bd9bc86f068ab06ad4a3ed45aafae

memory/2872-46-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/2744-45-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/2744-43-0x0000000003980000-0x0000000003B7D000-memory.dmp

memory/2744-42-0x0000000003980000-0x0000000003B7D000-memory.dmp

memory/2872-52-0x0000000002860000-0x0000000002A5D000-memory.dmp

memory/2800-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2872-63-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/2776-62-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2776-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2776-58-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2800-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2776-73-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2800-76-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-78-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-83-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-85-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-88-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-90-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-92-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-95-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2800-97-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 19:01

Reported

2024-11-13 19:03

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3696 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3316 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3316 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 3696 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 3696 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2124 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4240 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 4240 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 3592 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3592 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3592 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4224 wrote to memory of 1552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4224 wrote to memory of 1552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4224 wrote to memory of 1552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3960 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3960 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3960 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2260 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2260 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2260 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe

"C:\Users\Admin\AppData\Local\Temp\a1b55be6b09d9a29939053f6bf787ad62b1c0af7f96e7397241acc9f335c3dca.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KJEDn.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

"C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp

Files

memory/3696-0-0x0000000000400000-0x00000000005FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KJEDn.txt

MD5 130a1ad614bfc1851533b7a02e302622
SHA1 6cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA256 4620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
SHA512 16b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.txt

MD5 b7a54016d6dc509552fa2069600fa57b
SHA1 c39a3497d1609be5b9ca7dc5bf14a962ad36d217
SHA256 2b250137429b48e7a0961702a03fae7ce8f07ec58c9eba56ee3ce4598a700725
SHA512 7095601b58a09d96b340658109e501967a5f8a38380096dfc8d6e8315a058da4c902f70d83f752827e790fc5ac7e85dd57d10002ec95f2ec77e28794538f4fbf

memory/3696-28-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/4240-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1208-41-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1208-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2124-48-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/1208-37-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4240-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1208-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4240-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-76-0x0000000000400000-0x000000000045C000-memory.dmp