616830e93c33240ff157b4eeeab1d1a3e9891d6410139afdbd4d01f075da0933

Analysis

user interaction
yes
max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Halloware (BerkayV).exe
Size 23.1MB
Sample260822-tezkhshq21
SHA256 616830e93c33240ff157b4eeeab1d1a3e9891d6410139afdbd4d01f075da0933
MD5 2701cf0c52d8d8d961f21f9952af15e7
SHA1 d8b9de327f95ba090e5606862003419388fc3dc7
SHA512 b4798cd526b116e943f3cba6f58175185898e374efd4ab7afe012495858c7997fb1fba1dac284ae4aa484dfc5f70b6240ad1281d90c9a3642e49edd95ab39110
SSDEEP 196608:puv1iLrYSZWLN0dLeGyI8bMU+Ns3tlHO8:UdiHZZWLN1cu3tlHF
TLSH
T1D3371217B62E5209C596113BCD7088C20835EC45AF3145B37BEABF4F6AE529306B2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\Halloware\\permaban.vbs\""	wscript.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	wscript.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 20 IoCs

exploit

pid	Process
1548	icacls.exe
5704	icacls.exe
5452	takeown.exe
2356	icacls.exe
4668	icacls.exe
4108	takeown.exe
4896	takeown.exe
620	icacls.exe
3612	takeown.exe
3764	icacls.exe
5828	takeown.exe
4600	takeown.exe
5916	icacls.exe
1648	takeown.exe
3852	takeown.exe
4992	takeown.exe
1716	icacls.exe
1540	takeown.exe
4188	icacls.exe
1932	icacls.exe

Executes dropped EXE 5 IoCs

pid	Process
1236	LogonUI.exe
1672	kosuyorum.exe
428	Hware.exe
4868	LogonUI.exe
5680	LogonUI.exe

Modifies file permissions 1 TTPs 20 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1548	icacls.exe
3852	takeown.exe
5704	icacls.exe
4188	icacls.exe
620	icacls.exe
1932	icacls.exe
1716	icacls.exe
1540	takeown.exe
4896	takeown.exe
3612	takeown.exe
5916	icacls.exe
5452	takeown.exe
4992	takeown.exe
4668	icacls.exe
4600	takeown.exe
1648	takeown.exe
2356	icacls.exe
3764	icacls.exe
5828	takeown.exe
4108	takeown.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4092	tasklist.exe
3984	tasklist.exe
5732	tasklist.exe
5828	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\logonUI.exe	cmd.exe
File opened for modification	C:\Windows\System32\taskmgr.exe	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
3380	wscript.exe
5084	wscript.exe
2564	wscript.exe
3828	wscript.exe
5740	wscript.exe
3900	wscript.exe
2184	wscript.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\Halloware\inyer.wav	wscript.exe
File created	C:\Program Files\Halloware\template.vbs	wscript.exe
File opened for modification	C:\Program Files\Halloware\backup\winload.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\bcdedit.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\taskmgr.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\notepad.bak	cmd.exe
File created	C:\Program Files\Halloware\screwup.vbs	wscript.exe
File created	C:\Program Files\Halloware\bin\pump.ico	wscript.exe
File created	C:\Program Files\Halloware\delc.bat	wscript.exe
File created	C:\Program Files\Halloware\fakelogon.vbs	wscript.exe
File created	C:\Program Files\Halloware\findit.bat	wscript.exe
File created	C:\Program Files\Halloware\backup\winload.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\bcdedit.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\notepad.bak	cmd.exe
File created	C:\Program Files\Halloware\Hware.exe	wscript.exe
File created	C:\Program Files\Halloware\backup\csrss.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\logonUI.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\regedit.bak	cmd.exe
File created	C:\Program Files\Halloware\bin\pumpcur.cur	wscript.exe
File created	C:\Program Files\Halloware\data\fakelogon.exe	wscript.exe
File created	C:\Program Files\Halloware\takeact.vbs	wscript.exe
File created	C:\Program Files\Halloware\backup\logonUI.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\rundll32.bak	cmd.exe
File created	C:\Program Files\Halloware\intf.wav	wscript.exe
File created	C:\Program Files\Halloware\iQShell.vbs	wscript.exe
File created	C:\Program Files\Halloware\permaban.vbs	wscript.exe
File created	C:\Program Files\Halloware\takeown.bat	wscript.exe
File opened for modification	C:\Program Files\Halloware\backup\sethc.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\csrss.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\explorer.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\rundll32.bak	cmd.exe
File created	C:\Program Files\Halloware\kosuyorum.exe	wscript.exe
File created	C:\Program Files\Halloware\bin\@tile@@.jpg	wscript.exe
File created	C:\Program Files\Halloware\backup\sethc.bak	cmd.exe
File created	C:\Program Files\Halloware\backup\explorer.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\regedit.bak	cmd.exe
File opened for modification	C:\Program Files\Halloware\backup\taskmgr.bak	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe	cmd.exe
File created	C:\Windows\notepad.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5968	cmd.exe
3268	cmd.exe
3360	cmd.exe
1188	cmd.exe
2960	cmd.exe
3192	cmd.exe
1444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LogonUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halloware (BerkayV).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LogonUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosuyorum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LogonUI.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\Halloware\\bin\\pumpcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\Halloware\\bin\\pumpcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\Halloware\\bin\\pumpcur.cur"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors	wscript.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	kosuyorum.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	kosuyorum.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	kosuyorum.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	kosuyorum.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	kosuyorum.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\VBScriptSetScriptStateStarted = "240749187"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	LogonUI.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\Halloware\\bin\\pump.ico"	wscript.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1540	takeown.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeTakeOwnershipPrivilege	3852	takeown.exe
Token: SeTakeOwnershipPrivilege	4896	takeown.exe
Token: SeTakeOwnershipPrivilege	5452	takeown.exe
Token: SeTakeOwnershipPrivilege	3612	takeown.exe
Token: SeTakeOwnershipPrivilege	4992	takeown.exe
Token: SeTakeOwnershipPrivilege	5828	takeown.exe
Token: SeTakeOwnershipPrivilege	4600	takeown.exe
Token: SeTakeOwnershipPrivilege	1648	takeown.exe
Token: SeTakeOwnershipPrivilege	4108	takeown.exe
Token: SeShutdownPrivilege	3004	shutdown.exe
Token: SeRemoteShutdownPrivilege	3004	shutdown.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: 33	1260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1260	AUDIODG.EXE
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	5828	tasklist.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 5084	4900	Halloware (BerkayV).exe	89
PID 5084 wrote to memory of 3268	5084	wscript.exe	90
PID 3268 wrote to memory of 2564	3268	cmd.exe	92
PID 5084 wrote to memory of 3828	5084	wscript.exe	93
PID 3828 wrote to memory of 3360	3828	wscript.exe	94
PID 3828 wrote to memory of 1188	3828	wscript.exe	96
PID 3360 wrote to memory of 1540	3360	cmd.exe	98
PID 1188 wrote to memory of 4092	1188	cmd.exe	99
PID 3360 wrote to memory of 1548	3360	cmd.exe	100
PID 3360 wrote to memory of 3852	3360	cmd.exe	101
PID 3360 wrote to memory of 5704	3360	cmd.exe	103
PID 3360 wrote to memory of 4896	3360	cmd.exe	104
PID 3360 wrote to memory of 4188	3360	cmd.exe	105
PID 3360 wrote to memory of 5452	3360	cmd.exe	106
PID 3360 wrote to memory of 620	3360	cmd.exe	108
PID 3360 wrote to memory of 3612	3360	cmd.exe	109
PID 3360 wrote to memory of 2356	3360	cmd.exe	110
PID 3360 wrote to memory of 4992	3360	cmd.exe	111
PID 3360 wrote to memory of 3764	3360	cmd.exe	112
PID 3360 wrote to memory of 5828	3360	cmd.exe	113
PID 3360 wrote to memory of 4668	3360	cmd.exe	114
PID 3360 wrote to memory of 4600	3360	cmd.exe	115
PID 3360 wrote to memory of 5916	3360	cmd.exe	116
PID 3360 wrote to memory of 1648	3360	cmd.exe	117
PID 3360 wrote to memory of 1932	3360	cmd.exe	118
PID 3360 wrote to memory of 4108	3360	cmd.exe	119
PID 3360 wrote to memory of 1716	3360	cmd.exe	120
PID 3828 wrote to memory of 3004	3828	wscript.exe	121
PID 1236 wrote to memory of 5740	1236	LogonUI.exe	124
PID 5740 wrote to memory of 2960	5740	wscript.exe	125
PID 2960 wrote to memory of 3984	2960	cmd.exe	127
PID 5740 wrote to memory of 3192	5740	wscript.exe	128
PID 3192 wrote to memory of 1672	3192	cmd.exe	130
PID 1672 wrote to memory of 3900	1672	kosuyorum.exe	131
PID 3900 wrote to memory of 428	3900	wscript.exe	132
PID 4868 wrote to memory of 2184	4868	LogonUI.exe	135
PID 2184 wrote to memory of 1444	2184	wscript.exe	136
PID 5680 wrote to memory of 3380	5680	LogonUI.exe	140
PID 3380 wrote to memory of 5968	3380	wscript.exe	141
PID 5968 wrote to memory of 5828	5968	cmd.exe	143

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Users\Admin\AppData\Local\Temp\Halloware (BerkayV).exe
"C:\Users\Admin\AppData\Local\Temp\Halloware (BerkayV).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.vbs
  2⤵
  - UAC bypass
  - Executes a VBScript file via the Windows Script Host.
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5084
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo msgbox"Please wait while halloware infecting your computer",1+48,"Alert" > "C:\Users\Admin\AppData\Local\Temp\waitdude.vbs" & wscript.exe "C:\Users\Admin\AppData\Local\Temp\waitdude.vbs"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\waitdude.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2564
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Program files\halloware\takeact.vbs" RunAsAdministrator
    3⤵
    - Modifies WinLogon for persistence
    - Modifies Windows Defender DisableAntiSpyware settings
    - UAC bypass
    - Disables RegEdit via registry modification
    - Modifies system executable filetype association
    - Executes a VBScript file via the Windows Script Host.
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3828
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Program Files\Halloware\takeown.bat"
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\System32\takeown.exe
        
        takeown /f sethc.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\System32\icacls.exe
        
        icacls sethc.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1548
    - - C:\Windows\System32\takeown.exe
        
        takeown /f csrss.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
    - - C:\Windows\System32\icacls.exe
        
        icacls csrss.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5704
    - - C:\Windows\System32\takeown.exe
        
        takeown /f winload.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896
    - - C:\Windows\System32\icacls.exe
        
        icacls winload.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4188
    - - C:\Windows\System32\takeown.exe
        
        takeown /f logonUI.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452
    - - C:\Windows\System32\icacls.exe
        
        icacls logonUI.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:620
    - - C:\Windows\System32\takeown.exe
        
        takeown /f bcdedit.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
    - - C:\Windows\System32\icacls.exe
        
        icacls bcdedit.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2356
    - - C:\Windows\system32\takeown.exe
        
        takeown /f explorer.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
    - - C:\Windows\system32\icacls.exe
        
        icacls explorer.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3764
    - - C:\Windows\system32\takeown.exe
        
        takeown /f notepad.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
    - - C:\Windows\system32\icacls.exe
        
        icacls sethc.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4668
    - - C:\Windows\system32\takeown.exe
        
        takeown /f regedit.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
    - - C:\Windows\system32\icacls.exe
        
        icacls regedit.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5916
    - - C:\Windows\System32\takeown.exe
        
        takeown /f taskmgr.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
    - - C:\Windows\System32\icacls.exe
        
        icacls taskmgr.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1932
    - - C:\Windows\System32\takeown.exe
        
        takeown /f rundll32.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\System32\icacls.exe
        
        icacls rundll32.exe /granted "Admin":F /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files\halloware\findit.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq kosuyorum.exe"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" -r -t 00
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3004

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a33055 /state1:0x41c64e6d
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Windows\Temp\81A9.tmp\81AA.vbs /flags:0x4 /state0:0xa3a33055 /state1:0x41c64e6d
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files\halloware\findit.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq kosuyorum.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3984
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd\ & cd "Program Files"& cd Halloware & Kosuyorum.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Program Files\Halloware\kosuyorum.exe
      Kosuyorum.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\system32\wscript.exe
        
        "C:\Windows\sysnative\wscript.exe" C:\Windows\Temp\8B10.tmp\8B11.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3900
      - C:\Program Files\halloware\Hware.exe
        
        "C:\Program Files\halloware\Hware.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B0 0x00000000000004BC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39d4855 /state1:0x41c64e6d
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Windows\Temp\6C09.tmp\6C1A.vbs /flags:0x0 /state0:0xa39d4855 /state1:0x41c64e6d
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files\halloware\findit.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:1444
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq kosuyorum.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5732

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39ee055 /state1:0x41c64e6d
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Windows\Temp\5679.tmp\567A.vbs /flags:0x0 /state0:0xa39ee055 /state1:0x41c64e6d
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files\halloware\findit.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq kosuyorum.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A20.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.vbs
Size 1KB
SHA256 45ebca60ff5d7e0cb71bc0e310b34fd4aeee5de0c7aba895d979742bcfa0559a
MD5 889a8f5bb195b72c33c48448fd516a1c
SHA1 744b4c40d2527a98e589cc8a04735cfdb92f5079
SHA512 3251f61b5a4c9daaae9c9725aaea8d6b7cdfaa4523711f742046f7c78473d9b554932e38a4e3eaa4f4c4bcf87ff562ea2599c7ec4781e67e8f2c499b0cafe367
TLSH
T11521EF18AC57CA1B23916D810608BD40E3631A58BA39C576F7EBF352D1017E4853E4DD
MD5 SHA1 SHA512 TLSH

Submit Download

Hware.exe

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\Hware.exe
Size 7.5MB
SHA256 a516f678551bdd89e8543483700c329dd5b1f661dea8fdbb6421a57824906c4e
MD5 5b457c190f21d6dace76b0495f4aa07c
SHA1 289ec2d9541eb6734d187556955f1386196508e2
SHA512 a9b315835b68ac4ffe3a4e5eb720d8cacae62fb01377b0d47b86b7b10b526e03fbecbe41140140c305a99e6c00020b6bf1562b09495ae4ba7133616351e78527
SSDEEP 98304:asmyucu18DtLrYSZWJVLN0dpheeBh15C+lS9FM0Ixabl2UXFAGGDNsDHj1l8Vkn5:fuv1iLrYSZWLN0dLeGyI8bMU+Ns3tlH
TLSH
T1D786330B4402C40AF6BBEA7D18F40E90DD6A9846322D96775DA175D3D88A3F130DB6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@tile@@.jpg

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\bin\@tile@@.jpg
Size 17KB
SHA256 25f194995cf4073a0c2e6625c3ad0514848cc5e4224f5c726e5d73bc81b694d1
MD5 bfd5ee0327c8d108bd8e2d851a9ed06a
SHA1 55221d5e1d383cdff5bf0d7694d57bcde09d2faf
SHA512 1c456da1da57c0711a2277ffd02e7136d2c1b3d16a3d36dfc66ac67e3f4e9c1d3ca7b536e057da7cd4c37a59c0ded2ea9d5d2ac6cf729d1ccd50d91017ede219
SSDEEP 384:PcxwQ0zYPEE05unqESMlFB/pRoR3lZDvTDxavRo7:6wKV4Ml7CVZ7TDAvE
TLSH
T12F82C0FA9C5FF08ADD1F0F2631A62EE467FE24E362C158B084F9A04DD166AD8511CF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pump.ico

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\bin\pump.ico
Size 178KB
SHA256 c1d88f290da08027adc76649f54db6b352b76149dc2b3d9cddb7cf50d8af0cff
MD5 5df1f3790dd3b9df63f12a6f13277338
SHA1 7de32dc31c5360aea9024cd02bd4643e11fe2119
SHA512 fe858c60c3312a40a88cb5aa9a8ee9483d38973cecb356f55ab6dfa422eed25820dbe75bb40301849c9931e0ab8571af5b8102c082b518116343e50ff40c3d27
SSDEEP 1536:BmXZQszJGV515aU/xTgzVk1vAyYNq6/O3AujGmNfPYZddsz4y:BmnzJgk03YAbay
TLSH
T1FB04FE2BB73E6209C592207BCE75DDD7107ADD92BE3241727FCA3B460AE855A0221F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pumpcur.cur

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\bin\pumpcur.cur
Size 4KB
SHA256 6cee1cb2cf41b5c0fd969ed062b9d4e2c1f7c921cd886d1df1b0725a301074f0
MD5 d7197b2f55db9bd83c859a5e8b46a0d7
SHA1 598af4d8bcc14c411c48454dfb0caa2e79c1728d
SHA512 7f55208ee395bf6d063ab0af26b0a8e64e3d4fcacf4958db8577183c7588e7be51b6a7144e28f067d8bab7fca34e1100b0e37750bb8b16b5c02492f4d315a366
SSDEEP 48:JusyLQJ+ulJDzQbAnq8J0wUzEE8Vpz+Xw9QQuWyR8:JycJdNhCeq8
TLSH
T141911D81205863F6D088BEFFCB31E526C348BDC9C53099C748F87D3AB76641C3995AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fakelogon.exe

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\data\fakelogon.exe
Size 58KB
SHA256 43ce074b438577b487f6a7e31a877477d1d294e5c1b9c979b30a23fb12c13fa5
MD5 8f9b8205dba67cf950f20e3a0efbcc3a
SHA1 b50651abd1bcc78c374847caa36a44110d87d5cd
SHA512 4dc26fb94004d3dafeb95126ce07fd51e095b6327375448a70fe3aa9e5ca36d8424ffa572810cf2399afa3c0bc4fccdbb46f51c5fb783729d6fd2faa3044a505
SSDEEP 768:7fiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQO:gIxKWLvFn43bovQtu7qo43jjRDf4YOx
TLSH
T1AF435B43DAC125A2DBC2467441A735A3DA6C9767A3348EC7EF2C2883FF615E189341ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delc.bat

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\delc.bat
Size 258B
SHA256 1e6eeb8f777e1ecf1fa728e64134f979f9451ada735dc03d42c6fdf55de987bc
MD5 40e381411edd280ece4372ff39f721c5
SHA1 6d90aada218e0cdeadf0fa4c83f90dbcfe2258cd
SHA512 195b9df9fd49af3b9aa355589219cfa2161c363d979f3b4a6ea9c20e3849f48dbee731f7cde76ca5c4c910f25f89499b4363740897b708acc09b9871b8494d3c
TLSH
T172D02345C81FCFD0A53C1568932DE248694F10FA150CC07073D3F1E5A0315BA4316EB4
MD5 SHA1 SHA512 TLSH

Submit Download

fakelogon.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\fakelogon.vbs
Size 572B
SHA256 164c41744381d3ded7d2e95e76313763be9acfc21ea082f7126c149b1c287fe2
MD5 2ee899c0289cb575bf4852ac5d164f9d
SHA1 33e1e4c5a6facd78736998c6673ca6ec88e62fe7
SHA512 1edfa4b05cb738a3521918b23c5bd2e621e31ec5d19886d30675c14f9c6f5742ebf6572c14d33726ec1a9d468f324195fd33d3dce2ae1be1185712dab2f20baf
TLSH
T144F05C235C01C22692496DD60665E856C2E34C443777A520F7D9F78ED0543B048660D5
MD5 SHA1 SHA512 TLSH

Submit Download

findit.bat

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\findit.bat
Size 85B
SHA256 165141a4cd207304eb0d0e49cb33364ca74acf521a2f0a002bc60f14fe19378e
MD5 54de83a183d4520fad36ad02d9747e63
SHA1 15caddac8a52ae3632510292e6eb6bf9a728ae45
SHA512 fa5a20b2ec169f4573a859e1cef294330fe0ce700f043de634b2d6f8832ac67a17185dc48ce433b5b9ba43eb2d703f9b0a3ac37014cbc55e467125674d09707e
TLSH
T115A01223051E0D2493420DC305C48204D580C0119469031802818504D6F414120CBB99
MD5 SHA1 SHA512 TLSH

Submit Download

intf.wav

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\intf.wav
Size 7.5MB
SHA256 1eeee51a2b501f8b2f77d4f75fb415b7d0b99355fd80e8b4740a4e768996e400
MD5 5794a32dfeb072f764ab82fffa4d309d
SHA1 36d2dbdddd3b5ebc7d7bbd04d5fe3c46e4be39d0
SHA512 c2a2602257b86af9729a64c362b8e8711867e6cf2c0bb02d44711ccdac1514d4d80baefc7f16e595390bfe04d66a2aada88dab2d5442e390633123db6e4104f7
SSDEEP 12288:12L5RWKuZ3ApX6s6qjY8CDhDwoBXYbBvbXClDQwRZEUmtI7Ae:+RWKuZ3MX6rqcdJwKXWIQwEXto
TLSH
T1B286011BF422AF4ED29956336C8080412D06FC5D6F518AAB843BDF0F71B62175AC7E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inyer.wav

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\inyer.wav
Size 7.5MB
SHA256 f143806d771cc73065dfe593d23c46fb0d0946c88c0934d6624f79fcc246e4b3
MD5 c1c8536e675d25027c962abe0d3faf43
SHA1 13e6375da0162b19db7f8ad74640ce80b8aa73c4
SHA512 c0c6769fa1adccbe616fe24241a93f283aca18acfe7da09ab776b8cd106bbf88811929b8080b85529f3015e70ee54d87c0ff70a636b4494858d9e9504cac6768
SSDEEP 6144:V+noV30uGv/Hi665I5TdNUR49n3QZ+6wvLq+51L5iDV0pxip66AbkrhQY/m:wwTK/HWI5TYRw3QZqvH7ap6nbkN1e
TLSH
T19E86AE57F163AB12D6AA4A354C9189141D51FC0C3F16CA3BA039FF07BA7B3931E523A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kosuyorum.exe

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\kosuyorum.exe
Size 58KB
SHA256 5d8d77501ee9745ede78a2a93d035275b2feffc1f96d2c312ac71cadaa2cf5fb
MD5 7eba5d99235b23ca60597c8aa970f47f
SHA1 7d0c86680e2c32e709baa4907e9e4eeba51bedad
SHA512 80301c3de8ec2f1ab2e56df73010d5eae73b2fcd0fd31a7b288f282a33807a56073412f9d85b1e5d21635fa9d51fce7615158bf52ae9dea60f14a9ff3fbeae87
SSDEEP 768:zfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQb:IIxKWLvFn43bovQtu7qo43jjRDf4CO2
TLSH
T162435B43DAC125A2DBC6467441A735A3DA6D8767A3348EC7EF2C2883FF615E189301ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permaban.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\permaban.vbs
Size 357B
SHA256 a78161a3b89248d65ae00630eb33d3c934b6c7c3086f373fdd52d58756b20a8a
MD5 b343125051c1c6e3089b4820446bafab
SHA1 ee1d90b463d9f911d032a520df6b5066aca7fa50
SHA512 ecc6f407892dfa438eab22a67c004760599b8b5fea747ac5c7274180424d2ea95e1e13b10dd8026d641537ef666b74ca5251428eb567cd55241d6334ae64d881
TLSH
T14CE0A7497916C11A639EAE4387629C15D2E34E007632A042FBC7F38DC1153640917199
MD5 SHA1 SHA512 TLSH

Submit Download

screwup.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\screwup.vbs
Size 61B
SHA256 778cb71c42d697f365084ba1c0f499324bfdcdd67054644d8ff336af9c3e7f80
MD5 6a51becc27363870d2e17a43a9bb4bf0
SHA1 201a12e580cfa5bfac8cbc0c6936fd9cd60a349a
SHA512 ca843d2b3072a7c3b939207c60069e5f4a0fd7a17d7bfb513b9739d9d25fd24148f17540867037e5793aab067dbbcf760df22d865fc5e511d7617f1f56c4efc4
TLSH
T1A0A0029D804956D790A59009789406639D144755598842807B4A82D1E2BAE175708557
MD5 SHA1 SHA512 TLSH

Submit Download

takeact.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\takeact.vbs
Size 2KB
SHA256 43f18ae77ca9e61dc76be9ea5aabf81776372a3e26ae03a33af5eecfd8db4e70
MD5 cfad575eb56b1059f428ed81fc4194d5
SHA1 ff91f34a63f7fa01090643191b39d5742ef8ffe0
SHA512 c9832b50f3545419368ec5c655c9451037cdc3a78546c2306698c27f735bd25dedcbb9579ae482cca41583e58ce990ea10a55c9b12332bccd4694dc3f2f2835f
TLSH
T1C7410E44A423CA3BA2D2BD4116DEAE019377AD38A3A08CB7F1DAB352955379C50614DE
MD5 SHA1 SHA512 TLSH

Submit Download

takeown.bat

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\takeown.bat
Size 1KB
SHA256 3482c840695951907b291f979a6f8e98246a3b4ec119c9947d2a9e9676067710
MD5 d477e71d1d7080cf90aba3100b9c761a
SHA1 7642aa8aeabd847519cfd20ae7d7f2d8edb83914
SHA512 cc47c86a904bd2462f1a396ede5f1ea5b0c3eb6f5e6c6e6d966975612249958d9814910450aeff7c6d056bcf9893315a989dbd99b34111db7078592ef325563d
TLSH
T1EA319A99248B8998E3422F882B49750BE243DAAC93194571F35D834EB76187CA811EFF
MD5 SHA1 SHA512 TLSH

Submit Download

template.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\fileler\template.vbs
Size 402B
SHA256 98ddf649d3cafb5130069be87e569082d9dc780ce11f0dc0208348acff0baa55
MD5 1c04a184e8ba8025bb98cd1734a93b68
SHA1 55f09dde9ae0cebdbe23893c6dbc42549a23a912
SHA512 60bbfe5cab8e10589a6e24a46d86138f5161579b207b9b8349a8680a84996d94430ef65afdc1bfa124b8b8c93ae68b932a3dfc6a45a418a89453d784670fd296
TLSH
T1F9E05BC77915C01E2349BDC34966945D81F34F041D32E550FDD5F758D21137C1E5699E
MD5 SHA1 SHA512 TLSH

Submit Download

waitdude.vbs

Path C:\Users\Admin\AppData\Local\Temp\waitdude.vbs
Size 76B
SHA256 c1430e747ddc860d216c77a7445dbc8cf5fc4bee4bca47521333148dd93a3e6a
MD5 f1fbb313731d2b699a48c588486e7f0d
SHA1 d70c472a451b074ebd1cf55a42bc8843fa9cfd2f
SHA512 12d10b8ac14327b2874dd68b9b0b3d29add7fc96cd371e7ab74e25cb69b42b7a79a16b4ac489cb51214014035baf6ba0c48ec1a123b265c57b57d25939e6bf2e
TLSH
T15BA02228CC3C2003030003CA00883EC0280820F82B020203BBCE83E222E830A3CAF80B
MD5 SHA1 SHA512 TLSH

Submit Download

8B11.vbs

Path C:\Windows\Temp\8B10.tmp\8B11.vbs
Size 117B
SHA256 0f3f6a34bbfe0bf01ef189a50402f560d212a3e74a8867a8a76b70b4f6a25f61
MD5 43ce46af5d7f1ffe2c3914ad9c654fa3
SHA1 a98dce4efa618334d57a808d766f821d83d2a75d
SHA512 d1c59cf92412684bae18b497a5c9dd823073210150e0a18e69649910bc9f9c192298e242e89c04ccd88550e2f0b21881fbc13879d5c07a0e727c13e8d7186942
TLSH
T192B01234BC48C26B300495C70F31F881C7C01D89791AA934B3CDE39AE150774193F182
MD5 SHA1 SHA512 TLSH

Submit Download

msc.ddd

Path C:\logfilex7\msc.ddd
Size 64B
SHA256 943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2
MD5 dea052a2ad11945b1960577c0192f2eb
SHA1 1d02626a05a546a90c05902b2551f32c20eb3708
SHA512 5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917
TLSH
T12AA0220F3A8003AC008003830288E2820F0C20CC8B22803230C30888000A038B83B0F2
MD5 SHA1 SHA512 TLSH

Submit Download

msc.ddd

Path C:\logfilex7\msc.ddd
Size 236B
SHA256 0f0f0c112cc040751deafad872c24cada31ba5b746a0dbff71f574417fbb4a13
MD5 f327b4a9740d6b7cfc1edef4b67a8795
SHA1 0c3cf5fcb447793b463d638cd7b02db7984555ee
SHA512 13faab244567b55fb246a0c2c2f9ff6a99d6bf544e903f42a4ac03ef6d79a74fdbc69887c06c45868d2978bbcd969a209a414fe64e49a5e71472747ce1a0b386
TLSH
T19FD0928102590B75418DF07360B96012FA3D4822333D2369F08E60A4B394B5617CA880
MD5 SHA1 SHA512 TLSH

Submit Download

msc.ddd

Path C:\logfilex7\msc.ddd
Size 236B
SHA256 39fcf7946d9834220d575e169f329e97959628624212b0de0d0eefac72238893
MD5 a1039c1439674451fec8b341f6908b59
SHA1 f343056ab7da4fe6717d9b130439ae796c8fcb90
SHA512 c32a90ba0aabd4c89f5326fedb7c528758935224522693554fb2ae8b6383fee50fd50b6baa7bb72dbbaea686024042c4b6e3c320cad8bbd83a33fd95c14a4c17
TLSH
T1B9D0928102590BB1418CF57360A95012FA3E4831333E2369F0CE2094B34474617DAC80
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-69-0x0000000000E00000-0x0000000001584000-memory.dmp

Download

memory/428-70-0x0000000005270000-0x000000000582A000-memory.dmp

Download

memory/428-71-0x0000000004D50000-0x0000000004DE2000-memory.dmp

Download

memory/428-72-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

Download

memory/4900-0-0x000000000040F000-0x0000000000410000-memory.dmp

Download

memory/4900-58-0x000000000040F000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads