Edit tour

Windows Analysis Report
https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe

Overview

General Information

Sample URL:	https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe
Analysis ID:	1540362
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found pyInstaller with non standard icon

Modifies existing user documents (likely ransomware behavior)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Sigma detected: Suspicious desktop.ini Action

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,6360710991559555093,7547686259353660829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4900 --field-trial-handle=1888,i,6360710991559555093,7547686259353660829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

TheTrueFriend.exe (PID: 2528 cmdline: "C:\Users\user\Downloads\TheTrueFriend.exe" MD5: 2345503234E8E31D072AB294FBD4DA67)

TheTrueFriend.exe (PID: 3540 cmdline: "C:\Users\user\Downloads\TheTrueFriend.exe" MD5: 2345503234E8E31D072AB294FBD4DA67)

chrome.exe (PID: 3600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

notepad.exe (PID: 4080 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\encryption_notification.txt MD5: 27F71B12CB585541885A31BE22F61C83)

rundll32.exe (PID: 5144 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Downloads\TheTrueFriend.exe, ProcessId: 3540, TargetFilename: C:\Users\user\Downloads\desktop.ini

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49714 version: TLS 1.2

Source: C:\Users\user\Downloads\TheTrueFriend.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File opened: C:\Users\user\
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI25282\
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File opened: C:\Users\user\AppData\Local\Temp\

Source: chrome.exe

Memory has grown: Private usage: 25MB later: 39MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49714 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Downloads\TheTrueFriend.exe	File deleted: C:\Users\user\Desktop\EOWRVPQCCS\GIGIYTFFYT.png
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File deleted: C:\Users\user\Desktop\EOWRVPQCCS.docx
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File deleted: C:\Users\user\Desktop\ZGGKNSUKOP\ZGGKNSUKOP.docx
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File deleted: C:\Users\user\Desktop\EIVQSAOTAQ\KLIZUSIQEN.xlsx
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File deleted: C:\Users\user\Desktop\EIVQSAOTAQ\UNKRLCVOHV.png

Source: classification engine

Classification label: mal48.rans.win@27/960@9/87

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Users\user\Downloads\TheTrueFriend.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI25282

Source: C:\Users\user\Downloads\TheTrueFriend.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,6360710991559555093,7547686259353660829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4900 --field-trial-handle=1888,i,6360710991559555093,7547686259353660829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,6360710991559555093,7547686259353660829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4900 --field-trial-handle=1888,i,6360710991559555093,7547686259353660829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\TheTrueFriend.exe "C:\Users\user\Downloads\TheTrueFriend.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\TheTrueFriend.exe "C:\Users\user\Downloads\TheTrueFriend.exe"
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Process created: C:\Users\user\Downloads\TheTrueFriend.exe "C:\Users\user\Downloads\TheTrueFriend.exe"
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Process created: C:\Users\user\Downloads\TheTrueFriend.exe "C:\Users\user\Downloads\TheTrueFriend.exe"
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\encryption_notification.txt
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: tcl86t.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: tk86t.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: userenv.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: zlib1.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: samcli.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 841325.crdownload	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\python312.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\python3.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\tk86t.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_queue.pyd	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\e9b904d1-fa9d-4614-9bf7-5fb88df07782.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\select.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI25282\libcrypto-3.dll	Jump to dropped file

Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\python312.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\python3.dll	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\select.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Downloads\TheTrueFriend.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI25282\_ssl.pyd	Jump to dropped file

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Rundll32	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI25282\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\_tkinter.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\tcl86t.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\tk86t.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI25282\zlib1.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
discord.com	162.159.135.232	true	false	unknown
github.com	140.82.121.4	true	false	unknown
raw.githubusercontent.com	185.199.108.133	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
162.159.135.232	discord.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540362
Start date and time:	2024-10-23 17:35:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.rans.win@27/960@9/87

Process:	C:\Users\user\Downloads\TheTrueFriend.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 14:35:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9837636175737847
Encrypted:	false
SSDEEP:
MD5:	C2A9DA2CB225F7AD5CC785FADCE77EBA
SHA1:	C175CAD89D9D7CDF11F2BBEF3BC7A6650A7634C1
SHA-256:	9C5F22F3B5BDCDAC10108E878EB80416439D7751CA506C70B17F7F052B973C16
SHA-512:	E82A5068C6B8911F03CFFF37477E39BABB51E3E669CDB80CFA6FEB7E180F0591068C34495D1C705361866DA53E14FEA1CE5BBEE1A998EC2671A7DF8B41FB0AC1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....^..:a%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IWYn\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYv\|....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYv\|....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYv\|..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VWYx\|...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI25282\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI25282\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_cffi_backend.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\auto.tcl

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\clock.tcl

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\ascii.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\big5.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cns11643.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1250.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1251.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1252.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1253.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1254.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1255.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1256.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1257.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp1258.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp437.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp737.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp775.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp850.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp852.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp855.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp857.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp860.enc

C:\Users\user\AppData\Local\Temp\_MEI25282\_tcl_data\encoding\cp861.enc

Windows Analysis Report
https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre