c9626cf1f5171b65f88be1e87f27c0ea52aad7b91477c7734ae3ec3c5b6eeb0a

Analysis

max time kernel
9s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Output.exe
Size 1013KB
Sample260416-sethtsez81
SHA256 c9626cf1f5171b65f88be1e87f27c0ea52aad7b91477c7734ae3ec3c5b6eeb0a
MD5 5b4b7564be70e197b2154dfbd790bd47
SHA1 48c8ecbccd4bbc116dfb05dfc24c817711a4918c
SHA512 6237f50e8ae757a630bb53f0c60a50e06dc68b9139a2a85c38647eee218a9d182ad3a0f13964894028734a52dd3e8acdb82ebc42e371ec94c69ab0803860fc67
SSDEEP 12288:HZ0rqcEnMy+Js3M9G2TGplin5nD8IZ4Ls4aEYRk8mFEMX+QV6L4Iaywx0SZAr/mK:Ce89GBI5ngIJANeFwx0DTm/TzdnY
TLSH
T1AB250131630CF110FEB214309FF6F24FB2779B58CA447A19E6485A5B8E972AAC1443E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
1836	PEEKABOO.COM
3444	HighHappy.exe
3684	MBR2.exe
4208	TROLL5.exe
3660	TROLL2.exe

Modifies system executable filetype association 2 TTPs 34 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	HighHappy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HighHappy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\ActivatableClassId\App.AppX5eewbfjxqp2h0jdzqm11n8sqs0tx2wks.mca	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.UpdateTask\PackageId\MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vssm\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020821-0000-0000-C000-000000000046}\Verb\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\fonfile\shell\preview	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dct	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}\VersionIndependentProgID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020900-0000-0000-C000-000000000046}\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CompressedFolder\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ConflictFolder\shellex\PropertySheetHandlers\Standard	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odctablefile	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020907-0000-0000-C000-000000000046}\DataFormats	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.divx\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\DPI.Unaware.AppXjfk1mgekja4enqszpv8bcvpeea	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mapimail\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\AuxUserType\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\App.AppX4ncqz34bbtt07eqzhagpn4c10ehep	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppsx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rpc\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{942bc614-676c-464e-b384-d3202aaa02da}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.Windows.PeopleExperienceHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy\ActivatableClassId	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rul\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A249E9F6-5B28-4ED1-8AF0-C9B9C5195486}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.erf\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xml\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\dqyfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64818D11-4F9B-11CF-86EA-00AA00B929E8}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CommunicatorMeetingJoinAx.JoinManager	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.p7c	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\AppXde74bfzw9j31bzhcvsrxsyjnhhbq66cs\Shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{096CBB6C-221A-4A5D-B609-0C7534E3EE1F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F5F5-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Chart.5	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.ShareTarget\PackageId	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.mka\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5504BE45-A83B-4808-900A-3A5C36E7F77A}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetBinaryMacroEnabled.12\Protocol\StdFileEditing\Verb\0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.Windows.NarratorQuickStart_10.0.22000.1_neutral_neutral_8wekyb3d8bbwe	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\AppXq0pwa73vfcn2qdexp8cexcc6qk87xh1r\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F80E-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C025571B2A687A53689168CD7369889B	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F7F6-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.gvi	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5E176815-9A63-4A69-810F-62E90D36612A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EABCECDB-CC1C-4A6F-B4E3-7F888A5ADFC8}\Conversion\Readable	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\ActivatableClassId\App.AppXfkx01a1e4v1g002ca1kmk2mz6d6ebraf.mca\CustomProperties	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.kdc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\change-pin	reg.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe
3444	HighHappy.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	HighHappy.exe
Token: SeDebugPrivilege	3444	HighHappy.exe
Token: 33	1496	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1496	AUDIODG.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1836	3404	Output.exe	80
PID 3404 wrote to memory of 3444	3404	Output.exe	81
PID 3444 wrote to memory of 908	3444	HighHappy.exe	82
PID 3444 wrote to memory of 4064	3444	HighHappy.exe	85
PID 3444 wrote to memory of 1744	3444	HighHappy.exe	86
PID 1744 wrote to memory of 3592	1744	cmd.exe	89
PID 1836 wrote to memory of 3684	1836	PEEKABOO.COM	90
PID 1836 wrote to memory of 4208	1836	PEEKABOO.COM	91
PID 1836 wrote to memory of 3660	1836	PEEKABOO.COM	92

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Roaming\PEEKABOO.COM
  "C:\Users\Admin\AppData\Roaming\PEEKABOO.COM"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Roaming\MBR2.exe
    "C:\Users\Admin\AppData\Roaming\MBR2.exe"
    3⤵
    - Executes dropped EXE
    PID:3684
- - C:\Users\Admin\AppData\Roaming\TROLL5.exe
    "C:\Users\Admin\AppData\Roaming\TROLL5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4208
- - C:\Users\Admin\AppData\Roaming\TROLL2.exe
    "C:\Users\Admin\AppData\Roaming\TROLL2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3660
- C:\Users\Admin\AppData\Roaming\HighHappy.exe
  "C:\Users\Admin\AppData\Roaming\HighHappy.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C vssadmin delete shadows /for=C: /all
    3⤵
    - System Location Discovery: System Language Discovery
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /s /q "C:\Windows\System32"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000047C 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HighHappy.exe

Path C:\Users\Admin\AppData\Roaming\HighHappy.exe
Size 82KB
SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
MD5 788b0974f73acea93c7af807cbec1317
SHA1 8a5482beb542396efef378d2556698ba4aebf363
SHA512 487bab2035cef1a90f8c1f619af9b57784a4203b6291ef871db2340437f24184825ca931cb64f9fc58ebcc8b51e428f1261e8ff040cac2e919a285d00f8f1051
SSDEEP 1536:KahfyS/+TAODerDpbuEpPEUwsbuUrVzBq05j9aJggFSoHdduVm0A9SBwwVcl:KahfyS/+TAODer9bFpPEobbxN5M2gFSM
TLSH
T1F283A1557394E65AC4231735D991D3F4A730DD85EA46C34B36E8BE2B3EBD2E28E412C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Roaming\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PEEKABOO.COM

Path C:\Users\Admin\AppData\Roaming\PEEKABOO.COM
Size 921KB
SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
MD5 d0ae6aea701de9f127f91e7efdb50252
SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
TLSH
T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Roaming\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Roaming\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1836-17-0x0000000000EE0000-0x0000000000FCC000-memory.dmp

Download

memory/1836-19-0x000000001BD20000-0x000000001BD30000-memory.dmp

Download

memory/1836-21-0x000000001BD30000-0x000000001BE14000-memory.dmp

Download

memory/1836-62-0x0000000001800000-0x000000000180C000-memory.dmp

Download

memory/3404-20-0x0000000000DC0000-0x0000000000DCC000-memory.dmp

Download

memory/3404-0-0x0000000000310000-0x0000000000414000-memory.dmp

Download

memory/3444-66-0x0000000004C30000-0x0000000004CCC000-memory.dmp

Download

memory/3444-23-0x00000000058F0000-0x0000000005982000-memory.dmp

Download

memory/3444-22-0x00000000003D0000-0x00000000003EA000-memory.dmp

Download

memory/3660-77-0x0000000002230000-0x00000000022EB000-memory.dmp

Download

memory/3660-76-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3684-73-0x00000000026B0000-0x00000000026BC000-memory.dmp

Download

memory/3684-69-0x00000000026B0000-0x00000000026BC000-memory.dmp

Download

memory/3684-41-0x00000000006B0000-0x00000000006EA000-memory.dmp

Download

memory/4208-65-0x0000000005120000-0x000000000512A000-memory.dmp

Download

memory/4208-74-0x0000000002A80000-0x0000000002B1C000-memory.dmp

Download

memory/4208-64-0x0000000005650000-0x0000000005BF6000-memory.dmp

Download

memory/4208-75-0x0000000006C60000-0x0000000006CF6000-memory.dmp

Download

memory/4208-63-0x0000000000650000-0x0000000000708000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads