Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
KRITENESIAS.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
\Device\Harddisk0\DR0
|
DOS/MBR boot sector
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ar1l3lt.qch.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vc5qcrh.qhc.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4fwagcx.owr.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwzw5bs5.20n.psm1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\KRITENESIAS.exe
|
"C:\Users\user\Desktop\KRITENESIAS.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD
/d 1 /f
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t
REG_DWORD /d 1 /f
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD
/ d 1 / f
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c powershell wininit
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
powershell wininit
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7B6000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
78B000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
173000
|
stack
|
page read and write
|
||
|
3E50000
|
trusted library allocation
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
780000
|
heap
|
page read and write
|
||
|
6BE000
|
stack
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
A9000
|
stack
|
page read and write
|
||
|
22C0000
|
trusted library allocation
|
page read and write
|
||
|
C03000
|
unkown
|
page readonly
|
||
|
758000
|
heap
|
page read and write
|
||
|
318E000
|
stack
|
page read and write
|
||
|
C00000
|
unkown
|
page readonly
|
||
|
3070000
|
heap
|
page read and write
|
||
|
25E0000
|
heap
|
page read and write
|
||
|
2F0E000
|
stack
|
page read and write
|
||
|
73A000
|
heap
|
page read and write
|
||
|
245F000
|
stack
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
77E000
|
heap
|
page read and write
|
||
|
BF6000
|
unkown
|
page readonly
|
||
|
320E000
|
stack
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
788000
|
heap
|
page read and write
|
||
|
2B70000
|
heap
|
page read and write
|
||
|
2F40000
|
heap
|
page read and write
|
||
|
259E000
|
stack
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
78B000
|
heap
|
page read and write
|
||
|
258E000
|
stack
|
page read and write
|
||
|
2B0D000
|
stack
|
page read and write
|
||
|
92E000
|
stack
|
page read and write
|
||
|
3B04000
|
heap
|
page read and write
|
||
|
3210000
|
heap
|
page read and write
|
||
|
BEE000
|
stack
|
page read and write
|
||
|
3A60000
|
trusted library allocation
|
page read and write
|
||
|
3260000
|
heap
|
page read and write
|
||
|
75C000
|
heap
|
page read and write
|
||
|
77E000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
2470000
|
trusted library allocation
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
24B0000
|
trusted library allocation
|
page read and write
|
||
|
780000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
2DCD000
|
stack
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
77E000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
2600000
|
heap
|
page read and write
|
||
|
C00000
|
unkown
|
page readonly
|
||
|
53E000
|
stack
|
page read and write
|
||
|
75C000
|
heap
|
page read and write
|
||
|
786000
|
heap
|
page read and write
|
||
|
BF0000
|
unkown
|
page readonly
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
73E000
|
heap
|
page read and write
|
||
|
77E000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
2F8F000
|
stack
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
BF6000
|
unkown
|
page readonly
|
||
|
5A5000
|
heap
|
page read and write
|
||
|
758000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
755000
|
heap
|
page read and write
|
||
|
31CF000
|
stack
|
page read and write
|
||
|
3260000
|
heap
|
page read and write
|
||
|
3A80000
|
trusted library allocation
|
page read and write
|
||
|
7BF000
|
heap
|
page read and write
|
||
|
74C000
|
heap
|
page read and write
|
||
|
25D0000
|
heap
|
page read and write
|
||
|
7B7000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
5A9000
|
heap
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
22E0000
|
trusted library allocation
|
page read and write
|
||
|
2F10000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
2FF8000
|
heap
|
page read and write
|
||
|
758000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
3300000
|
heap
|
page read and write
|
||
|
22AF000
|
stack
|
page read and write
|
||
|
730000
|
heap
|
page read and write
|
||
|
3A3B000
|
stack
|
page read and write
|
||
|
4C4C000
|
stack
|
page read and write
|
||
|
2540000
|
heap
|
page read and write
|
||
|
6F0000
|
heap
|
page read and write
|
||
|
3B00000
|
heap
|
page read and write
|
||
|
783000
|
heap
|
page read and write
|
||
|
47D000
|
stack
|
page read and write
|
||
|
786000
|
heap
|
page read and write
|
||
|
759000
|
heap
|
page read and write
|
||
|
43D000
|
stack
|
page read and write
|
||
|
5B5000
|
heap
|
page read and write
|
||
|
75D000
|
heap
|
page read and write
|
||
|
268F000
|
stack
|
page read and write
|
||
|
303D000
|
stack
|
page read and write
|
||
|
2300000
|
trusted library allocation
|
page read and write
|
||
|
24F0000
|
trusted library allocation
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
2BFF000
|
stack
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
BF1000
|
unkown
|
page execute read
|
||
|
BF1000
|
unkown
|
page execute read
|
||
|
788000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
7B6000
|
heap
|
page read and write
|
||
|
264E000
|
stack
|
page read and write
|
||
|
32E0000
|
heap
|
page read and write
|
||
|
3308000
|
heap
|
page read and write
|
||
|
7BF000
|
heap
|
page read and write
|
||
|
7BF000
|
heap
|
page read and write
|
||
|
2ACD000
|
stack
|
page read and write
|
||
|
325F000
|
stack
|
page read and write
|
||
|
269F000
|
stack
|
page read and write
|
||
|
2490000
|
trusted library allocation
|
page read and write
|
||
|
2698000
|
heap
|
page read and write
|
||
|
2690000
|
heap
|
page read and write
|
||
|
7BF000
|
heap
|
page read and write
|
||
|
BF0000
|
unkown
|
page readonly
|
||
|
783000
|
heap
|
page read and write
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
783000
|
heap
|
page read and write
|
||
|
235E000
|
stack
|
page read and write
|
||
|
410000
|
heap
|
page read and write
|
||
|
57E000
|
stack
|
page read and write
|
||
|
C03000
|
unkown
|
page readonly
|
||
|
25CF000
|
stack
|
page read and write
|
||
|
2BBE000
|
stack
|
page read and write
|
There are 133 hidden memdumps, click here to show them.