Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
vm-uw.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Windows\Fonts\systkm32\csrss.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Windows\Fonts\systkm32\vv.bat
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat
|
ASCII text, with no line terminators
|
modified
|
||
|
C:\Windows\Fonts\systkm32\1.ini
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\Fonts\systkm32\svchost.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\vm-uw.exe
|
"C:\Users\user\Desktop\vm-uw.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systkm32\vv.bat" "
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\HZ~F6EC.tmp.bat"
|
|
|
|
C:\Windows\SysWOW64\PING.EXE
|
ping 127.0.0.1
|
|
|
|
C:\Windows\SysWOW64\PING.EXE
|
ping 127.0.0.1 -n 2
|
|
|
|
C:\Windows\Fonts\systkm32\csrss.exe
|
C:\Windows\Fonts\systkm32\csrss.exe WMPNetworkSxc C:\Windows\Fonts\systkm32\svchost.exe
|
|
|
|
C:\Windows\SysWOW64\PING.EXE
|
ping 127.0.0.1
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v Description /d "Shares Windows Media Player
libraries to other networked players and media devices using Universal Plug and Play." /t reg_sz /f
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc /v DisplayName /d "Windows Media Player Network
Sharing Service." /t reg_sz /f
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v AppDirectory /d "C:\Windows\Fonts\systkm32"
/t reg_sz /f
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSxc\Parameters /v Application /d ""C:\Program Files
(x86)\VMware\VMware Workstation\vmware.exe" -x "C:\Windows\Logs\ubu\3333.vmx"" /t reg_sz /f
|
|
|
|
C:\Windows\SysWOW64\PING.EXE
|
ping 127.0.0.1
|
|
|
|
C:\Windows\Fonts\systkm32\svchost.exe
|
C:\Windows\Fonts\systkm32\svchost.exe
|
|
|
|
C:\Windows\SysWOW64\PING.EXE
|
ping 127.0.0.1
|
|
|
|
C:\Windows\System32\svchost.exe
|
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\mode.com
|
mode con: cols=16 lines=2
|
||
|
C:\Windows\SysWOW64\sc.exe
|
sc start WMPNetworkSxc
|
||
|
C:\Windows\SysWOW64\regini.exe
|
regini 1.ini
|
There are 11 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://haozip.2345.cc/
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
127.0.0.1
|
unknown
|
unknown
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSxc
|
Description
|
||
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSxc
|
DisplayName
|
||
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSxc\Parameters
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSxc\Parameters
|
AppDirectory
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
FF9000
|
heap
|
page read and write
|
||
|
800000
|
heap
|
page read and write
|
||
|
2B1F000
|
stack
|
page read and write
|
||
|
279E000
|
stack
|
page read and write
|
||
|
2AF0000
|
heap
|
page read and write
|
||
|
FDE000
|
heap
|
page read and write
|
||
|
E05000
|
heap
|
page read and write
|
||
|
24F000
|
unkown
|
page readonly
|
||
|
29F0000
|
heap
|
page read and write
|
||
|
EEE000
|
stack
|
page read and write
|
||
|
294E000
|
stack
|
page read and write
|
||
|
2A3C2E55000
|
heap
|
page read and write
|
||
|
101C000
|
heap
|
page read and write
|
||
|
26EC000
|
stack
|
page read and write
|
||
|
249000
|
unkown
|
page read and write
|
||
|
230000
|
unkown
|
page readonly
|
||
|
F90000
|
heap
|
page read and write
|
||
|
C20DFFE000
|
unkown
|
page readonly
|
||
|
DEC000
|
stack
|
page read and write
|
||
|
FDE000
|
heap
|
page read and write
|
||
|
C20E6FE000
|
stack
|
page read and write
|
||
|
4A0F000
|
stack
|
page read and write
|
||
|
2A20000
|
heap
|
page read and write
|
||
|
2B4E000
|
stack
|
page read and write
|
||
|
2B9F000
|
stack
|
page read and write
|
||
|
2A3C2E40000
|
heap
|
page read and write
|
||
|
32E0000
|
heap
|
page read and write
|
||
|
3890000
|
heap
|
page read and write
|
||
|
1DF000
|
stack
|
page read and write
|
||
|
4C50000
|
trusted library allocation
|
page read and write
|
||
|
3210000
|
heap
|
page read and write
|
||
|
101C000
|
heap
|
page read and write
|
||
|
2A00000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
24F000
|
unkown
|
page readonly
|
||
|
2D0000
|
heap
|
page read and write
|
||
|
11AE000
|
stack
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
19E000
|
stack
|
page read and write
|
||
|
2B5E000
|
stack
|
page read and write
|
||
|
34BE000
|
stack
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2A32000
|
heap
|
page read and write
|
||
|
22D000
|
stack
|
page read and write
|
||
|
2FA7000
|
heap
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
59E000
|
stack
|
page read and write
|
||
|
490E000
|
stack
|
page read and write
|
||
|
2A3C2E00000
|
heap
|
page read and write
|
||
|
1003000
|
heap
|
page read and write
|
||
|
290000
|
heap
|
page read and write
|
||
|
1E1000
|
unkown
|
page execute read
|
||
|
600000
|
heap
|
page read and write
|
||
|
2BD7000
|
heap
|
page read and write
|
||
|
120000
|
heap
|
page read and write
|
||
|
612000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2A80000
|
direct allocation
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
DAF000
|
stack
|
page read and write
|
||
|
26B0000
|
heap
|
page read and write
|
||
|
FCF000
|
heap
|
page read and write
|
||
|
2790000
|
heap
|
page read and write
|
||
|
4B4C000
|
stack
|
page read and write
|
||
|
11C5000
|
heap
|
page read and write
|
||
|
2A3C2E02000
|
heap
|
page read and write
|
||
|
29A0000
|
heap
|
page read and write
|
||
|
C20E2FE000
|
stack
|
page read and write
|
||
|
2680000
|
heap
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
80B000
|
heap
|
page read and write
|
||
|
2A40000
|
heap
|
page read and write
|
||
|
263D000
|
stack
|
page read and write
|
||
|
FF5000
|
heap
|
page read and write
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
2897000
|
heap
|
page read and write
|
||
|
2A3C3000000
|
heap
|
page read and write
|
||
|
2A3C2DE0000
|
heap
|
page read and write
|
||
|
1059000
|
heap
|
page read and write
|
||
|
23CD000
|
stack
|
page read and write
|
||
|
2DE000
|
stack
|
page read and write
|
||
|
2670000
|
heap
|
page read and write
|
||
|
CFA000
|
stack
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
1E0000
|
unkown
|
page readonly
|
||
|
4C4D000
|
stack
|
page read and write
|
||
|
35F0000
|
heap
|
page read and write
|
||
|
11CB000
|
heap
|
page read and write
|
||
|
FEB000
|
heap
|
page read and write
|
||
|
308E000
|
stack
|
page read and write
|
||
|
344F000
|
stack
|
page read and write
|
||
|
26D0000
|
heap
|
page read and write
|
||
|
402000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2BC0000
|
heap
|
page read and write
|
||
|
409000
|
unkown
|
page readonly
|
||
|
27DD000
|
stack
|
page read and write
|
||
|
812000
|
heap
|
page read and write
|
||
|
CFF000
|
stack
|
page read and write
|
||
|
1003000
|
heap
|
page read and write
|
||
|
407000
|
unkown
|
page read and write
|
||
|
24C000
|
unkown
|
page read and write
|
||
|
2908000
|
heap
|
page read and write
|
||
|
29F0000
|
heap
|
page read and write
|
||
|
2FA4000
|
heap
|
page read and write
|
||
|
240000
|
heap
|
page read and write
|
||
|
FB8000
|
heap
|
page read and write
|
||
|
C20E4FC000
|
stack
|
page read and write
|
||
|
FDA000
|
heap
|
page read and write
|
||
|
B00000
|
direct allocation
|
page read and write
|
||
|
1007000
|
heap
|
page read and write
|
||
|
246000
|
unkown
|
page write copy
|
||
|
271E000
|
stack
|
page read and write
|
||
|
540000
|
heap
|
page read and write
|
||
|
FD7000
|
heap
|
page read and write
|
||
|
23BF000
|
stack
|
page read and write
|
||
|
1003000
|
heap
|
page read and write
|
||
|
1031000
|
heap
|
page read and write
|
||
|
FE6000
|
heap
|
page read and write
|
||
|
11C0000
|
heap
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
11B0000
|
heap
|
page read and write
|
||
|
348E000
|
stack
|
page read and write
|
||
|
C20E7FE000
|
unkown
|
page readonly
|
||
|
DD000
|
stack
|
page read and write
|
||
|
54D000
|
stack
|
page read and write
|
||
|
237F000
|
stack
|
page read and write
|
||
|
33FE000
|
stack
|
page read and write
|
||
|
2750000
|
heap
|
page read and write
|
||
|
35F8000
|
heap
|
page read and write
|
||
|
1E0000
|
unkown
|
page readonly
|
||
|
300D000
|
stack
|
page read and write
|
||
|
FB0000
|
heap
|
page read and write
|
||
|
34CF000
|
stack
|
page read and write
|
||
|
2F9D000
|
stack
|
page read and write
|
||
|
58D000
|
stack
|
page read and write
|
||
|
FDA000
|
heap
|
page read and write
|
||
|
901000
|
heap
|
page read and write
|
||
|
4B0F000
|
stack
|
page read and write
|
||
|
25FD000
|
stack
|
page read and write
|
||
|
2D50000
|
heap
|
page read and write
|
||
|
2A3C30E0000
|
heap
|
page read and write
|
||
|
FE6000
|
heap
|
page read and write
|
||
|
2A3C2F02000
|
heap
|
page read and write
|
||
|
1003000
|
heap
|
page read and write
|
||
|
2720000
|
heap
|
page read and write
|
||
|
F4E000
|
stack
|
page read and write
|
||
|
2648000
|
heap
|
page read and write
|
||
|
26AC000
|
stack
|
page read and write
|
||
|
246000
|
unkown
|
page read and write
|
||
|
2890000
|
heap
|
page read and write
|
||
|
FDE000
|
heap
|
page read and write
|
||
|
C20E1FE000
|
unkown
|
page readonly
|
||
|
327D000
|
stack
|
page read and write
|
||
|
353E000
|
stack
|
page read and write
|
||
|
237E000
|
stack
|
page read and write
|
||
|
C20E0FE000
|
stack
|
page read and write
|
||
|
2A3C3602000
|
trusted library allocation
|
page read and write
|
||
|
2640000
|
heap
|
page read and write
|
||
|
28CE000
|
stack
|
page read and write
|
||
|
27E0000
|
heap
|
page read and write
|
||
|
2A3C2E13000
|
heap
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
1003000
|
heap
|
page read and write
|
||
|
FF9000
|
heap
|
page read and write
|
||
|
C20E5FE000
|
unkown
|
page readonly
|
||
|
945000
|
stack
|
page read and write
|
||
|
2760000
|
heap
|
page read and write
|
||
|
AFF000
|
stack
|
page read and write
|
||
|
81C000
|
heap
|
page read and write
|
||
|
28E000
|
stack
|
page read and write
|
||
|
2798000
|
heap
|
page read and write
|
||
|
2A3C2E24000
|
heap
|
page read and write
|
||
|
9D000
|
stack
|
page read and write
|
||
|
150000
|
heap
|
page read and write
|
||
|
C20E3FE000
|
unkown
|
page readonly
|
||
|
2D60000
|
heap
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
602000
|
heap
|
page read and write
|
||
|
2A24000
|
heap
|
page read and write
|
||
|
E00000
|
heap
|
page read and write
|
||
|
23BE000
|
stack
|
page read and write
|
||
|
29EE000
|
stack
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
34FE000
|
stack
|
page read and write
|
||
|
1003000
|
heap
|
page read and write
|
||
|
1DD000
|
stack
|
page read and write
|
||
|
3230000
|
heap
|
page read and write
|
||
|
290E000
|
stack
|
page read and write
|
||
|
2B0E000
|
stack
|
page read and write
|
||
|
3238000
|
heap
|
page read and write
|
||
|
1ED000
|
stack
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
621000
|
heap
|
page read and write
|
||
|
D6E000
|
stack
|
page read and write
|
||
|
3400000
|
heap
|
page read and write
|
||
|
323D000
|
stack
|
page read and write
|
||
|
407000
|
unkown
|
page write copy
|
||
|
2A3C2E3E000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
298F000
|
stack
|
page read and write
|
||
|
420000
|
heap
|
page read and write
|
||
|
230000
|
unkown
|
page readonly
|
||
|
275F000
|
stack
|
page read and write
|
||
|
101C000
|
heap
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
29F0000
|
direct allocation
|
page read and write
|
||
|
2A3C3570000
|
trusted library allocation
|
page read and write
|
||
|
283D000
|
stack
|
page read and write
|
||
|
36B0000
|
heap
|
page read and write
|
||
|
2900000
|
heap
|
page read and write
|
||
|
53E000
|
stack
|
page read and write
|
||
|
304E000
|
stack
|
page read and write
|
||
|
34D0000
|
heap
|
page read and write
|
||
|
1004000
|
heap
|
page read and write
|
||
|
2790000
|
heap
|
page read and write
|
||
|
247000
|
unkown
|
page write copy
|
||
|
2F5D000
|
stack
|
page read and write
|
||
|
FEB000
|
heap
|
page read and write
|
||
|
701000
|
heap
|
page read and write
|
||
|
23F0000
|
heap
|
page read and write
|
||
|
FEB000
|
heap
|
page read and write
|
||
|
550000
|
direct allocation
|
page read and write
|
||
|
FE9000
|
heap
|
page read and write
|
||
|
23FF000
|
stack
|
page read and write
|
||
|
336E000
|
stack
|
page read and write
|
||
|
FF9000
|
heap
|
page read and write
|
||
|
9FD000
|
stack
|
page read and write
|
||
|
FDA000
|
heap
|
page read and write
|
||
|
F0E000
|
stack
|
page read and write
|
||
|
1E1000
|
unkown
|
page execute read
|
||
|
2B50000
|
heap
|
page read and write
|
||
|
FD4000
|
heap
|
page read and write
|
||
|
409000
|
unkown
|
page readonly
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
2D67000
|
heap
|
page read and write
|
||
|
C20D95B000
|
stack
|
page read and write
|
||
|
27A0000
|
heap
|
page read and write
|
||
|
5F0000
|
heap
|
page read and write
|
||
|
2B90000
|
heap
|
page read and write
|
||
|
2CF000
|
stack
|
page read and write
|
||
|
C20DEFD000
|
stack
|
page read and write
|
There are 234 hidden memdumps, click here to show them.