Extracted

• • Target
    https://88-99-253-237.top/Getintopc.com/Marvelous_Designer_Enterprise_2025.0.127.rar?md5=5uoR0MPZALbvbhDPjOTWbw&expires=1791670500

  Score

  10^/10

  backdoorbootkitdiscoveryexecutiononyxc2persistenceprivilege_escalationransomwareupx

  • Family: OnyxC2

    OnyxC2 is a Windows backdoor written in C++.

    backdooronyxc2

  • Drops file in Drivers directory

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1