616830e93c33240ff157b4eeeab1d1a3e9891d6410139afdbd4d01f075da0933

Analysis

user interaction
yes
max time kernel
42s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Halloware (BerkayV).exe
Size 23.1MB
Sample260822-tezkhshq21
SHA256 616830e93c33240ff157b4eeeab1d1a3e9891d6410139afdbd4d01f075da0933
MD5 2701cf0c52d8d8d961f21f9952af15e7
SHA1 d8b9de327f95ba090e5606862003419388fc3dc7
SHA512 b4798cd526b116e943f3cba6f58175185898e374efd4ab7afe012495858c7997fb1fba1dac284ae4aa484dfc5f70b6240ad1281d90c9a3642e49edd95ab39110
SSDEEP 196608:puv1iLrYSZWLN0dLeGyI8bMU+Ns3tlHO8:UdiHZZWLN1cu3tlHF
TLSH
T1D3371217B62E5209C596113BCD7088C20835EC45AF3145B37BEABF4F6AE529306B2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\Halloware\\permaban.vbs\""	wscript.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	wscript.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 20 IoCs

exploit

pid	Process
4940	takeown.exe
384	icacls.exe
2800	takeown.exe
1528	icacls.exe
2012	takeown.exe
4504	icacls.exe
460	takeown.exe
5068	icacls.exe
1752	takeown.exe
4024	takeown.exe
3880	icacls.exe
988	takeown.exe
4692	icacls.exe
5092	takeown.exe
4904	icacls.exe
3660	takeown.exe
3896	icacls.exe
1348	icacls.exe
2336	icacls.exe
3676	takeown.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Halloware (BerkayV).exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

pid	Process
2028	LogonUI.exe
3364	kosuyorum.exe
4468	Hware.exe

Modifies file permissions 1 TTPs 20 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2800	takeown.exe
1528	icacls.exe
4024	takeown.exe
4504	icacls.exe
460	takeown.exe
2336	icacls.exe
3880	icacls.exe
3676	takeown.exe
4940	takeown.exe
5092	takeown.exe
3896	icacls.exe
1752	takeown.exe
1348	icacls.exe
4904	icacls.exe
2012	takeown.exe
3660	takeown.exe
5068	icacls.exe
384	icacls.exe
988	takeown.exe
4692	icacls.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1904	tasklist.exe
1044	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\taskmgr.exe	cmd.exe
File opened for modification	C:\Windows\System32\logonUI.exe	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs

execution

Visual Basic

T1059.005

pid	Process
3252	wscript.exe
2524	wscript.exe
2236	wscript.exe
1996	wscript.exe
1236	wscript.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File created	C:\Program Files\Halloware\kosuyorum.exe	wscript.exe
File created	C:\Program Files\Halloware\iQShell.vbs	wscript.exe
File created	C:\Program Files\Halloware\template.vbs	wscript.exe
File opened for modification	C:\Program Files\Halloware\backup\sethc.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\csrss.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\bcdedit.bak	cmd.exe
File created	C:\Program Files\Halloware\Hware.exe	wscript.exe
File created	C:\Program Files\Halloware\backup\explorer.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\regedit.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\logonUI.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\bcdedit.bak	cmd.exe
File created	C:\Program Files\Halloware\bin\pumpcur.cur	wscript.exe
File created	C:\Program Files\Halloware\data\fakelogon.exe	wscript.exe
File created	C:\Program Files\Halloware\backup\sethc.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\notepad.bak	cmd.exe
File created	C:\Program Files\Halloware\bin\@tile@@.jpg	wscript.exe
File created	C:\Program Files\Halloware\bin\pump.ico	wscript.exe
File opened for modification	C:\Program Files\Halloware\backup\winload.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\bin\@tile@@.jpg	wscript.exe
File created	C:\Program Files\Halloware\fakelogon.vbs	wscript.exe
File created	C:\Program Files\Halloware\findit.bat	wscript.exe
File created	C:\Program Files\Halloware\backup\winload.bak	cmd.exe
File created	C:\Program Files\Halloware\inyer.wav	wscript.exe
File created	C:\Program Files\Halloware\permaban.vbs	wscript.exe
File created	C:\Program Files\Halloware\backup\logonUI.bak	cmd.exe
File created	C:\Program Files\Halloware\delc.bat	wscript.exe
File created	C:\Program Files\Halloware\intf.wav	wscript.exe
File created	C:\Program Files\Halloware\screwup.vbs	wscript.exe
File created	C:\Program Files\Halloware\takeown.bat	wscript.exe
File opened for modification	C:\Program Files\Halloware\backup\csrss.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\explorer.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\notepad.bak	cmd.exe
File created	C:\Program Files\Halloware\takeact.vbs	wscript.exe
File created	C:\Program Files\Halloware\backup\regedit.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\taskmgr.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\taskmgr.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\rundll32.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\rundll32.bak	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe	cmd.exe
File created	C:\Windows\notepad.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4704	cmd.exe
3720	cmd.exe
4832	cmd.exe
3376	cmd.exe
1136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halloware (BerkayV).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LogonUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosuyorum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hware.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Cursors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\Halloware\\bin\\pumpcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\Halloware\\bin\\pumpcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\Halloware\\bin\\pumpcur.cur"	wscript.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTEncodeSetting = "6"	Hware.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	Hware.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	kosuyorum.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	kosuyorum.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	kosuyorum.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.msgsm610	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	kosuyorum.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Hware.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.msgsm610\MaxRTEncodeSetting = "4"	Hware.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.msgsm610\MaxRTDecodeSetting = "4"	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm	Hware.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTDecodeSetting = "6"	Hware.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	kosuyorum.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression Manager\	Hware.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression Manager	Hware.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4940	takeown.exe
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeTakeOwnershipPrivilege	1752	takeown.exe
Token: SeTakeOwnershipPrivilege	988	takeown.exe
Token: SeTakeOwnershipPrivilege	2800	takeown.exe
Token: SeTakeOwnershipPrivilege	5092	takeown.exe
Token: SeTakeOwnershipPrivilege	4024	takeown.exe
Token: SeTakeOwnershipPrivilege	2012	takeown.exe
Token: SeTakeOwnershipPrivilege	460	takeown.exe
Token: SeTakeOwnershipPrivilege	3660	takeown.exe
Token: SeTakeOwnershipPrivilege	3676	takeown.exe
Token: SeShutdownPrivilege	4432	shutdown.exe
Token: SeRemoteShutdownPrivilege	4432	shutdown.exe
Token: SeDebugPrivilege	1044	tasklist.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3252	4936	Halloware (BerkayV).exe	85
PID 3252 wrote to memory of 3376	3252	wscript.exe	87
PID 3376 wrote to memory of 2524	3376	cmd.exe	89
PID 3252 wrote to memory of 2236	3252	wscript.exe	90
PID 2236 wrote to memory of 1136	2236	wscript.exe	91
PID 2236 wrote to memory of 4704	2236	wscript.exe	93
PID 1136 wrote to memory of 4940	1136	cmd.exe	95
PID 1136 wrote to memory of 5068	1136	cmd.exe	96
PID 4704 wrote to memory of 1904	4704	cmd.exe	97
PID 1136 wrote to memory of 1752	1136	cmd.exe	98
PID 1136 wrote to memory of 384	1136	cmd.exe	99
PID 1136 wrote to memory of 988	1136	cmd.exe	100
PID 1136 wrote to memory of 4692	1136	cmd.exe	102
PID 1136 wrote to memory of 2800	1136	cmd.exe	103
PID 1136 wrote to memory of 1348	1136	cmd.exe	104
PID 1136 wrote to memory of 5092	1136	cmd.exe	105
PID 1136 wrote to memory of 1528	1136	cmd.exe	106
PID 1136 wrote to memory of 4024	1136	cmd.exe	108
PID 1136 wrote to memory of 4904	1136	cmd.exe	109
PID 1136 wrote to memory of 2012	1136	cmd.exe	110
PID 1136 wrote to memory of 4504	1136	cmd.exe	111
PID 1136 wrote to memory of 460	1136	cmd.exe	112
PID 1136 wrote to memory of 2336	1136	cmd.exe	113
PID 1136 wrote to memory of 3660	1136	cmd.exe	114
PID 1136 wrote to memory of 3880	1136	cmd.exe	115
PID 1136 wrote to memory of 3676	1136	cmd.exe	116
PID 1136 wrote to memory of 3896	1136	cmd.exe	117
PID 2236 wrote to memory of 4432	2236	wscript.exe	128
PID 2028 wrote to memory of 1996	2028	LogonUI.exe	131
PID 1996 wrote to memory of 3720	1996	wscript.exe	132
PID 3720 wrote to memory of 1044	3720	cmd.exe	134
PID 1996 wrote to memory of 4832	1996	wscript.exe	137
PID 4832 wrote to memory of 3364	4832	cmd.exe	139
PID 3364 wrote to memory of 1236	3364	kosuyorum.exe	140
PID 1236 wrote to memory of 4468	1236	wscript.exe	141

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Users\Admin\AppData\Local\Temp\Halloware (BerkayV).exe
"C:\Users\Admin\AppData\Local\Temp\Halloware (BerkayV).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\A15C.tmp\A15D.vbs
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3252
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo msgbox"Please wait while halloware infecting your computer",1+48,"Alert" > "C:\Users\Admin\AppData\Local\Temp\waitdude.vbs" & wscript.exe "C:\Users\Admin\AppData\Local\Temp\waitdude.vbs"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\waitdude.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2524
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Program files\halloware\takeact.vbs" RunAsAdministrator
    3⤵
    - Modifies WinLogon for persistence
    - Modifies Windows Defender DisableAntiSpyware settings
    - UAC bypass
    - Disables RegEdit via registry modification
    - Checks computer location settings
    - Modifies system executable filetype association
    - Executes a VBScript file via the Windows Script Host.
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2236
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Program Files\Halloware\takeown.bat"
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\Windows\System32\takeown.exe
        
        takeown /f sethc.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\System32\icacls.exe
        
        icacls sethc.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5068
    - - C:\Windows\System32\takeown.exe
        
        takeown /f csrss.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\icacls.exe
        
        icacls csrss.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:384
    - - C:\Windows\System32\takeown.exe
        
        takeown /f winload.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Windows\System32\icacls.exe
        
        icacls winload.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4692
    - - C:\Windows\System32\takeown.exe
        
        takeown /f logonUI.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Windows\System32\icacls.exe
        
        icacls logonUI.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1348
    - - C:\Windows\System32\takeown.exe
        
        takeown /f bcdedit.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
    - - C:\Windows\System32\icacls.exe
        
        icacls bcdedit.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1528
    - - C:\Windows\system32\takeown.exe
        
        takeown /f explorer.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
    - - C:\Windows\system32\icacls.exe
        
        icacls explorer.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4904
    - - C:\Windows\system32\takeown.exe
        
        takeown /f notepad.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
    - - C:\Windows\system32\icacls.exe
        
        icacls sethc.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4504
    - - C:\Windows\system32\takeown.exe
        
        takeown /f regedit.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:460
    - - C:\Windows\system32\icacls.exe
        
        icacls regedit.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2336
    - - C:\Windows\System32\takeown.exe
        
        takeown /f taskmgr.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
    - - C:\Windows\System32\icacls.exe
        
        icacls taskmgr.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3880
    - - C:\Windows\System32\takeown.exe
        
        takeown /f rundll32.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
    - - C:\Windows\System32\icacls.exe
        
        icacls rundll32.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files\halloware\findit.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq kosuyorum.exe"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" -r -t 00
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4432

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391b055 /state1:0x41c64e6d
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Windows\Temp\DF7E.tmp\DF7F.vbs /flags:0x4 /state0:0xa391b055 /state1:0x41c64e6d
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files\halloware\findit.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq kosuyorum.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd\ & cd "Program Files"& cd Halloware & Kosuyorum.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Program Files\Halloware\kosuyorum.exe
      Kosuyorum.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\system32\wscript.exe
        
        "C:\Windows\sysnative\wscript.exe" C:\Windows\Temp\E9CE.tmp\E9CF.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Program Files\halloware\Hware.exe
        
        "C:\Program Files\halloware\Hware.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:4468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x508
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A15D.vbs

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\A15D.vbs
Size 1KB
SHA256 45ebca60ff5d7e0cb71bc0e310b34fd4aeee5de0c7aba895d979742bcfa0559a
MD5 889a8f5bb195b72c33c48448fd516a1c
SHA1 744b4c40d2527a98e589cc8a04735cfdb92f5079
SHA512 3251f61b5a4c9daaae9c9725aaea8d6b7cdfaa4523711f742046f7c78473d9b554932e38a4e3eaa4f4c4bcf87ff562ea2599c7ec4781e67e8f2c499b0cafe367
TLSH
T11521EF18AC57CA1B23916D810608BD40E3631A58BA39C576F7EBF352D1017E4853E4DD
MD5 SHA1 SHA512 TLSH

Submit Download

Hware.exe

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\Hware.exe
Size 7.5MB
SHA256 a516f678551bdd89e8543483700c329dd5b1f661dea8fdbb6421a57824906c4e
MD5 5b457c190f21d6dace76b0495f4aa07c
SHA1 289ec2d9541eb6734d187556955f1386196508e2
SHA512 a9b315835b68ac4ffe3a4e5eb720d8cacae62fb01377b0d47b86b7b10b526e03fbecbe41140140c305a99e6c00020b6bf1562b09495ae4ba7133616351e78527
SSDEEP 98304:asmyucu18DtLrYSZWJVLN0dpheeBh15C+lS9FM0Ixabl2UXFAGGDNsDHj1l8Vkn5:fuv1iLrYSZWLN0dLeGyI8bMU+Ns3tlH
TLSH
T1D786330B4402C40AF6BBEA7D18F40E90DD6A9846322D96775DA175D3D88A3F130DB6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@tile@@.jpg

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\bin\@tile@@.jpg
Size 17KB
SHA256 25f194995cf4073a0c2e6625c3ad0514848cc5e4224f5c726e5d73bc81b694d1
MD5 bfd5ee0327c8d108bd8e2d851a9ed06a
SHA1 55221d5e1d383cdff5bf0d7694d57bcde09d2faf
SHA512 1c456da1da57c0711a2277ffd02e7136d2c1b3d16a3d36dfc66ac67e3f4e9c1d3ca7b536e057da7cd4c37a59c0ded2ea9d5d2ac6cf729d1ccd50d91017ede219
SSDEEP 384:PcxwQ0zYPEE05unqESMlFB/pRoR3lZDvTDxavRo7:6wKV4Ml7CVZ7TDAvE
TLSH
T12F82C0FA9C5FF08ADD1F0F2631A62EE467FE24E362C158B084F9A04DD166AD8511CF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pump.ico

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\bin\pump.ico
Size 178KB
SHA256 c1d88f290da08027adc76649f54db6b352b76149dc2b3d9cddb7cf50d8af0cff
MD5 5df1f3790dd3b9df63f12a6f13277338
SHA1 7de32dc31c5360aea9024cd02bd4643e11fe2119
SHA512 fe858c60c3312a40a88cb5aa9a8ee9483d38973cecb356f55ab6dfa422eed25820dbe75bb40301849c9931e0ab8571af5b8102c082b518116343e50ff40c3d27
SSDEEP 1536:BmXZQszJGV515aU/xTgzVk1vAyYNq6/O3AujGmNfPYZddsz4y:BmnzJgk03YAbay
TLSH
T1FB04FE2BB73E6209C592207BCE75DDD7107ADD92BE3241727FCA3B460AE855A0221F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pumpcur.cur

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\bin\pumpcur.cur
Size 4KB
SHA256 6cee1cb2cf41b5c0fd969ed062b9d4e2c1f7c921cd886d1df1b0725a301074f0
MD5 d7197b2f55db9bd83c859a5e8b46a0d7
SHA1 598af4d8bcc14c411c48454dfb0caa2e79c1728d
SHA512 7f55208ee395bf6d063ab0af26b0a8e64e3d4fcacf4958db8577183c7588e7be51b6a7144e28f067d8bab7fca34e1100b0e37750bb8b16b5c02492f4d315a366
SSDEEP 48:JusyLQJ+ulJDzQbAnq8J0wUzEE8Vpz+Xw9QQuWyR8:JycJdNhCeq8
TLSH
T141911D81205863F6D088BEFFCB31E526C348BDC9C53099C748F87D3AB76641C3995AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fakelogon.exe

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\data\fakelogon.exe
Size 58KB
SHA256 43ce074b438577b487f6a7e31a877477d1d294e5c1b9c979b30a23fb12c13fa5
MD5 8f9b8205dba67cf950f20e3a0efbcc3a
SHA1 b50651abd1bcc78c374847caa36a44110d87d5cd
SHA512 4dc26fb94004d3dafeb95126ce07fd51e095b6327375448a70fe3aa9e5ca36d8424ffa572810cf2399afa3c0bc4fccdbb46f51c5fb783729d6fd2faa3044a505
SSDEEP 768:7fiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQO:gIxKWLvFn43bovQtu7qo43jjRDf4YOx
TLSH
T1AF435B43DAC125A2DBC2467441A735A3DA6C9767A3348EC7EF2C2883FF615E189341ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delc.bat

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\delc.bat
Size 258B
SHA256 1e6eeb8f777e1ecf1fa728e64134f979f9451ada735dc03d42c6fdf55de987bc
MD5 40e381411edd280ece4372ff39f721c5
SHA1 6d90aada218e0cdeadf0fa4c83f90dbcfe2258cd
SHA512 195b9df9fd49af3b9aa355589219cfa2161c363d979f3b4a6ea9c20e3849f48dbee731f7cde76ca5c4c910f25f89499b4363740897b708acc09b9871b8494d3c
TLSH
T172D02345C81FCFD0A53C1568932DE248694F10FA150CC07073D3F1E5A0315BA4316EB4
MD5 SHA1 SHA512 TLSH

Submit Download

fakelogon.vbs

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\fakelogon.vbs
Size 572B
SHA256 164c41744381d3ded7d2e95e76313763be9acfc21ea082f7126c149b1c287fe2
MD5 2ee899c0289cb575bf4852ac5d164f9d
SHA1 33e1e4c5a6facd78736998c6673ca6ec88e62fe7
SHA512 1edfa4b05cb738a3521918b23c5bd2e621e31ec5d19886d30675c14f9c6f5742ebf6572c14d33726ec1a9d468f324195fd33d3dce2ae1be1185712dab2f20baf
TLSH
T144F05C235C01C22692496DD60665E856C2E34C443777A520F7D9F78ED0543B048660D5
MD5 SHA1 SHA512 TLSH

Submit Download

findit.bat

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\findit.bat
Size 85B
SHA256 165141a4cd207304eb0d0e49cb33364ca74acf521a2f0a002bc60f14fe19378e
MD5 54de83a183d4520fad36ad02d9747e63
SHA1 15caddac8a52ae3632510292e6eb6bf9a728ae45
SHA512 fa5a20b2ec169f4573a859e1cef294330fe0ce700f043de634b2d6f8832ac67a17185dc48ce433b5b9ba43eb2d703f9b0a3ac37014cbc55e467125674d09707e
TLSH
T115A01223051E0D2493420DC305C48204D580C0119469031802818504D6F414120CBB99
MD5 SHA1 SHA512 TLSH

Submit Download

intf.wav

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\intf.wav
Size 7.5MB
SHA256 1eeee51a2b501f8b2f77d4f75fb415b7d0b99355fd80e8b4740a4e768996e400
MD5 5794a32dfeb072f764ab82fffa4d309d
SHA1 36d2dbdddd3b5ebc7d7bbd04d5fe3c46e4be39d0
SHA512 c2a2602257b86af9729a64c362b8e8711867e6cf2c0bb02d44711ccdac1514d4d80baefc7f16e595390bfe04d66a2aada88dab2d5442e390633123db6e4104f7
SSDEEP 12288:12L5RWKuZ3ApX6s6qjY8CDhDwoBXYbBvbXClDQwRZEUmtI7Ae:+RWKuZ3MX6rqcdJwKXWIQwEXto
TLSH
T1B286011BF422AF4ED29956336C8080412D06FC5D6F518AAB843BDF0F71B62175AC7E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inyer.wav

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\inyer.wav
Size 7.5MB
SHA256 f143806d771cc73065dfe593d23c46fb0d0946c88c0934d6624f79fcc246e4b3
MD5 c1c8536e675d25027c962abe0d3faf43
SHA1 13e6375da0162b19db7f8ad74640ce80b8aa73c4
SHA512 c0c6769fa1adccbe616fe24241a93f283aca18acfe7da09ab776b8cd106bbf88811929b8080b85529f3015e70ee54d87c0ff70a636b4494858d9e9504cac6768
SSDEEP 6144:V+noV30uGv/Hi665I5TdNUR49n3QZ+6wvLq+51L5iDV0pxip66AbkrhQY/m:wwTK/HWI5TYRw3QZqvH7ap6nbkN1e
TLSH
T19E86AE57F163AB12D6AA4A354C9189141D51FC0C3F16CA3BA039FF07BA7B3931E523A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kosuyorum.exe

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\kosuyorum.exe
Size 58KB
SHA256 5d8d77501ee9745ede78a2a93d035275b2feffc1f96d2c312ac71cadaa2cf5fb
MD5 7eba5d99235b23ca60597c8aa970f47f
SHA1 7d0c86680e2c32e709baa4907e9e4eeba51bedad
SHA512 80301c3de8ec2f1ab2e56df73010d5eae73b2fcd0fd31a7b288f282a33807a56073412f9d85b1e5d21635fa9d51fce7615158bf52ae9dea60f14a9ff3fbeae87
SSDEEP 768:zfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQb:IIxKWLvFn43bovQtu7qo43jjRDf4CO2
TLSH
T162435B43DAC125A2DBC6467441A735A3DA6D8767A3348EC7EF2C2883FF615E189301ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permaban.vbs

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\permaban.vbs
Size 357B
SHA256 a78161a3b89248d65ae00630eb33d3c934b6c7c3086f373fdd52d58756b20a8a
MD5 b343125051c1c6e3089b4820446bafab
SHA1 ee1d90b463d9f911d032a520df6b5066aca7fa50
SHA512 ecc6f407892dfa438eab22a67c004760599b8b5fea747ac5c7274180424d2ea95e1e13b10dd8026d641537ef666b74ca5251428eb567cd55241d6334ae64d881
TLSH
T14CE0A7497916C11A639EAE4387629C15D2E34E007632A042FBC7F38DC1153640917199
MD5 SHA1 SHA512 TLSH

Submit Download

screwup.vbs

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\screwup.vbs
Size 61B
SHA256 778cb71c42d697f365084ba1c0f499324bfdcdd67054644d8ff336af9c3e7f80
MD5 6a51becc27363870d2e17a43a9bb4bf0
SHA1 201a12e580cfa5bfac8cbc0c6936fd9cd60a349a
SHA512 ca843d2b3072a7c3b939207c60069e5f4a0fd7a17d7bfb513b9739d9d25fd24148f17540867037e5793aab067dbbcf760df22d865fc5e511d7617f1f56c4efc4
TLSH
T1A0A0029D804956D790A59009789406639D144755598842807B4A82D1E2BAE175708557
MD5 SHA1 SHA512 TLSH

Submit Download

takeact.vbs

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\takeact.vbs
Size 2KB
SHA256 43f18ae77ca9e61dc76be9ea5aabf81776372a3e26ae03a33af5eecfd8db4e70
MD5 cfad575eb56b1059f428ed81fc4194d5
SHA1 ff91f34a63f7fa01090643191b39d5742ef8ffe0
SHA512 c9832b50f3545419368ec5c655c9451037cdc3a78546c2306698c27f735bd25dedcbb9579ae482cca41583e58ce990ea10a55c9b12332bccd4694dc3f2f2835f
TLSH
T1C7410E44A423CA3BA2D2BD4116DEAE019377AD38A3A08CB7F1DAB352955379C50614DE
MD5 SHA1 SHA512 TLSH

Submit Download

takeown.bat

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\takeown.bat
Size 1KB
SHA256 3482c840695951907b291f979a6f8e98246a3b4ec119c9947d2a9e9676067710
MD5 d477e71d1d7080cf90aba3100b9c761a
SHA1 7642aa8aeabd847519cfd20ae7d7f2d8edb83914
SHA512 cc47c86a904bd2462f1a396ede5f1ea5b0c3eb6f5e6c6e6d966975612249958d9814910450aeff7c6d056bcf9893315a989dbd99b34111db7078592ef325563d
TLSH
T1EA319A99248B8998E3422F882B49750BE243DAAC93194571F35D834EB76187CA811EFF
MD5 SHA1 SHA512 TLSH

Submit Download

template.vbs

Path C:\Users\Admin\AppData\Local\Temp\A15C.tmp\fileler\template.vbs
Size 402B
SHA256 98ddf649d3cafb5130069be87e569082d9dc780ce11f0dc0208348acff0baa55
MD5 1c04a184e8ba8025bb98cd1734a93b68
SHA1 55f09dde9ae0cebdbe23893c6dbc42549a23a912
SHA512 60bbfe5cab8e10589a6e24a46d86138f5161579b207b9b8349a8680a84996d94430ef65afdc1bfa124b8b8c93ae68b932a3dfc6a45a418a89453d784670fd296
TLSH
T1F9E05BC77915C01E2349BDC34966945D81F34F041D32E550FDD5F758D21137C1E5699E
MD5 SHA1 SHA512 TLSH

Submit Download

waitdude.vbs

Path C:\Users\Admin\AppData\Local\Temp\waitdude.vbs
Size 76B
SHA256 c1430e747ddc860d216c77a7445dbc8cf5fc4bee4bca47521333148dd93a3e6a
MD5 f1fbb313731d2b699a48c588486e7f0d
SHA1 d70c472a451b074ebd1cf55a42bc8843fa9cfd2f
SHA512 12d10b8ac14327b2874dd68b9b0b3d29add7fc96cd371e7ab74e25cb69b42b7a79a16b4ac489cb51214014035baf6ba0c48ec1a123b265c57b57d25939e6bf2e
TLSH
T15BA02228CC3C2003030003CA00883EC0280820F82B020203BBCE83E222E830A3CAF80B
MD5 SHA1 SHA512 TLSH

Submit Download

E9CF.vbs

Path C:\Windows\Temp\E9CE.tmp\E9CF.vbs
Size 117B
SHA256 0f3f6a34bbfe0bf01ef189a50402f560d212a3e74a8867a8a76b70b4f6a25f61
MD5 43ce46af5d7f1ffe2c3914ad9c654fa3
SHA1 a98dce4efa618334d57a808d766f821d83d2a75d
SHA512 d1c59cf92412684bae18b497a5c9dd823073210150e0a18e69649910bc9f9c192298e242e89c04ccd88550e2f0b21881fbc13879d5c07a0e727c13e8d7186942
TLSH
T192B01234BC48C26B300495C70F31F881C7C01D89791AA934B3CDE39AE150774193F182
MD5 SHA1 SHA512 TLSH

Submit Download

msc.ddd

Path C:\logfilex7\msc.ddd
Size 64B
SHA256 943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2
MD5 dea052a2ad11945b1960577c0192f2eb
SHA1 1d02626a05a546a90c05902b2551f32c20eb3708
SHA512 5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917
TLSH
T12AA0220F3A8003AC008003830288E2820F0C20CC8B22803230C30888000A038B83B0F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4468-115-0x0000000000F70000-0x00000000016F4000-memory.dmp

Download

memory/4468-116-0x00000000051C0000-0x0000000005764000-memory.dmp

Download

memory/4468-117-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Download

memory/4468-118-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

Download

memory/4936-0-0x000000000040F000-0x0000000000410000-memory.dmp

Download

memory/4936-101-0x000000000040F000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads