Windows Analysis Report
download.exe

Source: C:\Users\user\Desktop\download.exe	Code function: 0_2_00C03840	0_2_00C03840
Source: C:\Users\user\Desktop\download.exe	Code function: 0_2_00C0201D	0_2_00C0201D
Source: C:\Users\user\Desktop\download.exe	Code function: 0_2_00C030E3	0_2_00C030E3
Source: C:\Users\user\Desktop\download.exe	Code function: 0_2_00C0173C	0_2_00C0173C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0485A83C	2_2_0485A83C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0485C1E3	2_2_0485C1E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04852708	2_2_04852708
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0485B11D	2_2_0485B11D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0485C940	2_2_0485C940
Source: C:\Windows\2594.tmp	Code function: 11_2_00007FF73CFC5C00	11_2_00007FF73CFC5C00
Source: C:\Windows\dispci.exe	Code function: 23_2_00E018BC	23_2_00E018BC
Source: C:\Windows\dispci.exe	Code function: 23_2_00E00C8F	23_2_00E00C8F
Source: C:\Windows\dispci.exe	Code function: 23_2_00DF2800	23_2_00DF2800
Source: C:\Windows\dispci.exe	Code function: 23_2_00E011E0	23_2_00E011E0
Source: C:\Windows\dispci.exe	Code function: 23_2_00E025F4	23_2_00E025F4
Source: C:\Windows\dispci.exe	Code function: 23_2_00DF82CA	23_2_00DF82CA
Source: C:\Windows\dispci.exe	Code function: 23_2_00E0073E	23_2_00E0073E

Source: Joe Sandbox View

Dropped File: C:\Windows\cscc.dat 0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6

Source: C:\Windows\SysWOW64\wevtutil.exe

Process token adjusted: Security

Source: download.exe

Static PE information: invalid certificate

Source: download.exe, 00000000.00000002.1694487596.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashUtil.exev+ vs download.exe
Source: download.exe, 00000000.00000000.1692531626.0000000000C09000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFlashUtil.exev+ vs download.exe
Source: download.exe	Binary or memory string: OriginalFilenameFlashUtil.exev+ vs download.exe

Source: unknown

Driver loaded: C:\Windows\System32\cdd.dll

Source: download.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: download.exe, type: SAMPLE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.download.exe.10ce578.1.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.download.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.download.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.0.2594.tmp.7ff73cfc0000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Mimikatz_Comp date = 2017-10-25, hash1 = 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, author = Florian Roth, description = Auto-generated rule - file 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.3.rundll32.exe.2cb4d60.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 11.2.2594.tmp.7ff73cfc0000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Mimikatz_Comp date = 2017-10-25, hash1 = 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, author = Florian Roth, description = Auto-generated rule - file 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.2cb4d60.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 2.3.rundll32.exe.2cb4d60.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 2.3.rundll32.exe.2cb4d60.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 23.2.dispci.exe.df0000.0.unpack, type: UNPACKEDPE	Matched rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 date = 2017-10-24, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Christiaan Beek, description = Bad Rabbit Ransomware, source = https://pastebin.com/Y7pJv3tK, reference = BadRabbit
Source: 23.2.dispci.exe.df0000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.0.dispci.exe.df0000.0.unpack, type: UNPACKEDPE	Matched rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 date = 2017-10-24, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Christiaan Beek, description = Bad Rabbit Ransomware, source = https://pastebin.com/Y7pJv3tK, reference = BadRabbit
Source: 23.0.dispci.exe.df0000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.3.rundll32.exe.2cb4d60.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 2.3.rundll32.exe.2cb4d60.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 2.3.rundll32.exe.2cb4d60.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 2.2.rundll32.exe.2cb4d60.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 0.2.download.exe.10ce578.1.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.2c371b8.1.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.2c371b8.1.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.2c371b8.1.unpack, type: UNPACKEDPE	Matched rule: BadRabbit author = kevoreilly, description = BadRabbit Payload, cape_type = BadRabbit Payload
Source: 2.2.rundll32.exe.4850000.2.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.4850000.2.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.4850000.2.unpack, type: UNPACKEDPE	Matched rule: BadRabbit author = kevoreilly, description = BadRabbit Payload, cape_type = BadRabbit Payload
Source: 2.2.rundll32.exe.2c371b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.2c371b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.rundll32.exe.2c371b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit author = kevoreilly, description = BadRabbit Payload, cape_type = BadRabbit Payload
Source: 00000002.00000003.1717628248.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 date = 2017-10-24, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Christiaan Beek, description = Bad Rabbit Ransomware, source = https://pastebin.com/Y7pJv3tK, reference = BadRabbit
Source: C:\Windows\dispci.exe, type: DROPPED	Matched rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 date = 2017-10-24, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Christiaan Beek, description = Bad Rabbit Ransomware, source = https://pastebin.com/Y7pJv3tK, reference = BadRabbit
Source: C:\Windows\dispci.exe, type: DROPPED	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\cscc.dat, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions

Source: cscc.dat.2.dr

Binary string: configFlags\Device\dcrypt\DosDevices\dcryptdump_hiber_%s\$dcsys$$dcsys$\Device\CdRom%s\$DC_TRIM_%x$$dcsys$_fail_%xNTFSFATFAT32exFATRSDS

Source: rundll32.exe, 00000002.00000002.1754801710.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.1763238261.000000000485D000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5clDuVFr5sQxZ+feQlVvZcEK0k4uCSF5SkOkF9A3tR6O/xAt89/PVhowvu2TfBTRsnBs83hcFH8hjG2V5F5DxXFoSxpTqVsR4lOm5KB2S8ap4TinG/GN/SVNBFwllpRhV/vRWNmKgKIdROvkHxyALuJyUuCZlIoaJ5tB0YkATEHEyRsLcntZYsdwH1P+NmXiNg2MH5lZ9bEOk7YTMfwVKNqtHaX0LJOyAkx4NR0DPOFLDQONW9OOhZSkRx3V7PC3Q29HHhyiKVCPJsOW1l1mNtwL7KX+7kfNe0CefByEWfSBt1tbkvjdeP2xBnPjb3GE1GA/oGcGjrXc6wV8WKsfYQIDAQAB.3ds.7z.accdb.ai.asm.asp.aspx.avhd.back.bak.bmp.brw.c.cab.cc.cer.cfg.conf.cpp.crt.cs.ctl.cxx.dbf.der.dib.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.hpp.hxx.iso.java.jfif.jpe.jpeg.jpg.js.kdbx.key.mail.mdb.msg.nrg.odc.odf.odg.odi.odm.odp.ods.odt.ora.ost.ova.ovf.p12.p7b.p7c.pdf.pem.pfx.php.pmf.png.ppt.pptx.ps1.pst.pvi.py.pyc.pyw.qcow.qcow2.rar.rb.rtf.scm.sln.sql.tar.tib.tif.tiff.vb.vbox.vbs.vcb.vdi.vfd.vhd.vhdx.vmc.vmdk.vmsd.vmtm.vmx.vsdx.vsv.work.xls.xlsx.xml.xvd.zip.\AppData\ProgramData\Program Files\Windows.encrypted*..Readme.txt%s-h-f%dkernel32.dllIsWow64Process\\.\pipe\%ws"%ws" %wsiphlpapi.dllGetExtendedTcpTable%u.%u.%u.%uTERMSRV/127.0.0.1localhost0.0.0.0\rundll32.exe%ws C:\Windows\%ws,#1 %wsSeTcbPrivilegeSeShutdownPrivilegeSeDebugPrivilege%08X%08X/c %ws%wswevtutil cl %ws & SetupSystemSecurityApplicationfsutil usn deletejournal /D %c:schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "%ws" /ST %02d:%02d:00schtasks /Delete /F /TN drogon255.255.255.255%u.%u.%u.%uC:\Windows\System32\rundll32.exe "C:\Windows\",#2 \\%s\admin$\\%ws\admin$\%wsprocess call create "C:\Windows\System32\rundll32.exe \"C:\Windows\%s\" #1 "wbem\wmic.exe%ws WaitForMultipleObjectskernel32
Source: rundll32.exe, 00000002.00000003.1717628248.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, dispci.exe, 00000017.00000002.1802587914.0000000000E03000.00000002.00000001.01000000.00000007.sdmp, dispci.exe, 00000017.00000000.1746531825.0000000000E03000.00000002.00000001.01000000.00000007.sdmp, dispci.exe.2.dr	Binary or memory string: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5clDuVFr5sQxZ+feQlVvZcEK0k4uCSF5SkOkF9A3tR6O/xAt89/PVhowvu2TfBTRsnBs83hcFH8hjG2V5F5DxXFoSxpTqVsR4lOm5KB2S8ap4TinG/GN/SVNBFwllpRhV/vRWNmKgKIdROvkHxyALuJyUuCZlIoaJ5tB0YkATEHEyRsLcntZYsdwH1P+NmXiNg2MH5lZ9bEOk7YTMfwVKNqtHaX0LJOyAkx4NR0DPOFLDQONW9OOhZSkRx3V7PC3Q29HHhyiKVCPJsOW1l1mNtwL7KX+7kfNe0CefByEWfSBt1tbkvjdeP2xBnPjb3GE1GA/oGcGjrXc6wV8WKsfYQIDAQAB.3ds.7z.accdb.ai.asm.asp.aspx.avhd.back.bak.bmp.brw.c.cab.cc.cer.cfg.conf.cpp.crt.cs.ctl.cxx.dbf.der.dib.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.hpp.hxx.iso.java.jfif.jpe.jpeg.jpg.js.kdbx.key.mail.mdb.msg.nrg.odc.odf.odg.odi.odm.odp.ods.odt.ora.ost.ova.ovf.p12.p7b.p7c.pdf.pem.pfx.php.pmf.png.ppt.pptx.ps1.pst.pvi.py.pyc.pyw.qcow.qcow2.rar.rb.rtf.scm.sln.sql.tar.tib.tif.tiff.vb.vbox.vbs.vcb.vdi.vfd.vhd.vhdx.vmc.vmdk.vmsd.vmtm.vmx.vsdx.vsv.work.xls.xlsx.xml.xvd.zip.\AppData\ProgramData\Program Files\Windows.encrypted%lS OK

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@58/8@2/4

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04857CC5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,SetLastError,

2_2_04857CC5

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFindExtensionW,wsprintfW,GetLastError,WNetAddConnection2W,PathFileExistsW,GetLastError,GetLastError,WNetCancelConnection2W,OpenSCManagerW,memset,GetSystemTimeAsFileTime,wsprintfW,CreateServiceW,StartServiceW,GetLastError,QueryServiceStatus,Sleep,DeleteService,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,DeleteFileW,WNetCancelConnection2W,SetLastError,		2_2_04859534
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,		2_2_04851368

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_048584EE CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_048584EE

Source: C:\Windows\dispci.exe

Code function: 23_2_00DF5150 CoInitialize,CoCreateInstance,GetModuleFileNameW,GetVersion,ExpandEnvironmentStringsW,Sleep,CoUninitialize,

23_2_00DF5150

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04858313 FindResourceW,LoadResource,LockResource,SizeofResource,GetProcessHeap,GetProcessHeap,HeapAlloc,RtlAllocateHeap,memcpy,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,GetProcessHeap,RtlFreeHeap,

2_2_04858313

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_04859534

Source: C:\Windows\dispci.exe

File created: C:\Users\Public\Desktop\DECRYPT.lnk

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8180:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\82517A223AD6FDE5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7984:120:WilError_03

Source: download.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\download.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\download.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15

Source: download.exe	ReversingLabs: Detection: 97%
Source: download.exe	Virustotal: Detection: 88%

Source: C:\Users\user\Desktop\download.exe

File read: C:\Users\user\Desktop\download.exe

Source: unknown	Process created: C:\Users\user\Desktop\download.exe "C:\Users\user\Desktop\download.exe"
Source: C:\Users\user\Desktop\download.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\download.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Delete /F /TN rhaegal
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\2594.tmp "C:\Windows\2594.tmp" \\.\pipe\{D8F326F0-A034-43D5-AD41-3DA9EEB64FB1}
Source: C:\Windows\2594.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Setup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl System
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Security
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Application
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\fsutil.exe fsutil usn deletejournal /D C:
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C Start "" "C:\Windows\dispci.exe" -id 3065482610 && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\dispci.exe "C:\Windows\dispci.exe" -id 3065482610
Source: C:\Windows\dispci.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\dispci.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Delete /F /TN rhaegal
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Delete /F /TN drogon
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x4 /state0:0xa3f61055 /state1:0x41c64e6d
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN drogon
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f6c855 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f74055 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f04055 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: C:\Users\user\Desktop\download.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Delete /F /TN rhaegal	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\2594.tmp "C:\Windows\2594.tmp" \\.\pipe\{D8F326F0-A034-43D5-AD41-3DA9EEB64FB1}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Delete /F /TN drogon	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Setup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl System	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Security	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Application	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\fsutil.exe fsutil usn deletejournal /D C:	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\dispci.exe "C:\Windows\dispci.exe" -id 3065482610	Jump to behavior
Source: C:\Windows\dispci.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Delete /F /TN rhaegal	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN drogon	Jump to behavior

Source: C:\Users\user\Desktop\download.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\2594.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\dispci.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.logon.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xamlhost.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: languageoverlayutil.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.controls.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll

Source: C:\Windows\dispci.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Contains functionality to infect the boot sector

Source: DECRYPT.lnk.23.dr

LNK file: ..\..\..\Windows\dispci.exe

Source: download.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: lsasrv.pdb source: 2594.tmp, 0000000B.00000003.1719410656.0000000002EF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lsasrv.pdbUGP source: 2594.tmp, 0000000B.00000003.1719410656.0000000002EF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dcrypt.pdb source: rundll32.exe, 00000002.00000003.1717652685.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.1696516164.0000000002C9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.1754801710.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.1696854067.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, cscc.dat.2.dr

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04859016 VirtualProtect,LoadLibraryA,GetProcAddress,VirtualProtect,

2_2_04859016

Source: C:\Windows\dispci.exe

Code function: 23_2_00DF79B5 push ecx; ret

23_2_00DF79C8

Persistence and Installation Behavior

Source: C:\Windows\dispci.exe

Code function: __snwprintf,_malloc,CreateFileW,DeviceIoControl,CloseHandle,_free, \\.\PhysicalDrive%d

23_2_00DF39E0

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\Windows\2594.tmp			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\dispci.exe			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\cscc.dat			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\dispci.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\cscc.dat			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\dispci.exe			Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\dispci.exe

Code function: __snwprintf,_malloc,CreateFileW,DeviceIoControl,CloseHandle,_free, \\.\PhysicalDrive%d

23_2_00DF39E0

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_04859534

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_2-4958

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_2-4961

Source: C:\Windows\dispci.exe

Code function: 23_2_00DF3FC0 rdtsc

23_2_00DF3FC0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: memset,memset,GetAdaptersInfo,GetAdaptersInfo,LocalAlloc,GetAdaptersInfo,inet_addr,inet_addr,inet_addr,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,htonl,LocalAlloc,inet_addr,htonl,htonl,CreateThread,CloseHandle,LocalFree,	2_2_04858B2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetAdaptersInfo,NetServerGetInfo,NetApiBufferFree,	2_2_04857D4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetAdaptersInfo,GetComputerNameExW,DhcpEnumSubnets,DhcpGetSubnetInfo,DhcpEnumSubnetClients,htonl,htonl,htonl,inet_ntoa,GetProcessHeap,HeapFree,DhcpRpcFreeMemory,DhcpRpcFreeMemory,	2_2_04858D39

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 900000			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-5687

Source: C:\Windows\SysWOW64\rundll32.exe

Dropped PE file which has not been started: C:\Windows\cscc.dat

Jump to dropped file

Source: C:\Windows\dispci.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_23-8288
Source: C:\Windows\2594.tmp	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_11-3496

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7724	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7416	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7576	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04855E9F PathCombineW,FindFirstFileW,WaitForMultipleObjects,PathCombineW,StrStrIW,PathFindExtensionW,FindNextFileW,FindClose,		2_2_04855E9F
Source: C:\Windows\dispci.exe	Code function: 23_2_00DF1B80 PathCombineW,FindFirstFileW,WaitForMultipleObjects,PathCombineW,PathFindExtensionW,FindNextFileW,FindClose,		23_2_00DF1B80

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04855A73 GetSystemInfo,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,MapViewOfFile,CryptDuplicateHash,CryptHashData,LocalAlloc,CryptGetHashParam,LocalFree,CryptDestroyHash,UnmapViewOfFile,

2_2_04855A73

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 900000			Jump to behavior

Source: rundll32.exe, 00000002.00000002.1754801710.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.1754801710.0000000002D00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_2-4880
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_2-4969
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_2-4862
Source: C:\Windows\2594.tmp	API call chain: ExitProcess graph end node	graph_11-3497

Source: C:\Windows\System32\cdd.dll

System information queried: ModuleInformation

Source: C:\Windows\2594.tmp

Process information queried: ProcessInformation

Source: C:\Windows\dispci.exe

Code function: 23_2_00DF3FC0 rdtsc

23_2_00DF3FC0

Source: C:\Windows\2594.tmp

Code function: 11_2_00007FF73CFC5540 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00007FF73CFC5540

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04859016 VirtualProtect,LoadLibraryA,GetProcAddress,VirtualProtect,

2_2_04859016

Source: C:\Users\user\Desktop\download.exe

Code function: 0_2_00C010C0 GetModuleHandleW,GetModuleFileNameW,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,

0_2_00C010C0

Source: C:\Windows\2594.tmp

Process token adjusted: Debug

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\Desktop\download.exe	Code function: 0_2_00C01499 SetUnhandledExceptionFilter,UnhandledExcep,GetCurrentProcess,TerminateProcess,	0_2_00C01499
Source: C:\Windows\2594.tmp	Code function: 11_2_00007FF73CFC5540 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF73CFC5540
Source: C:\Windows\2594.tmp	Code function: 11_2_00007FF73CFC71F0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF73CFC71F0
Source: C:\Windows\2594.tmp	Code function: 11_2_00007FF73CFC57FC SetUnhandledExceptionFilter,	11_2_00007FF73CFC57FC
Source: C:\Windows\dispci.exe	Code function: 23_2_00DF5C9F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00DF5C9F
Source: C:\Windows\dispci.exe	Code function: 23_2_00DFA966 SetUnhandledExceptionFilter,	23_2_00DFA966
Source: C:\Windows\dispci.exe	Code function: 23_2_00DF7757 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00DF7757

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.0 139	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.1 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 173.222.162.32 445	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Setup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl System	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Security	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Application	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\fsutil.exe fsutil usn deletejournal /D C:	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\dispci.exe "C:\Windows\dispci.exe" -id 3065482610	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN rhaegal	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Delete /F /TN drogon	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04856FFE GetProcessHeap,GetProcessHeap,HeapAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,ConnectNamedPipe,PeekNamedPipe,Sleep,GetProcessHeap,HeapAlloc,ReadFile,StrChrW,GetProcessHeap,HeapFree,FlushFileBuffers,DisconnectNamedPipe,CloseHandle,

2_2_04856FFE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_0485841D GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,DuplicateToken,AllocateAndInitializeSid,CheckTokenMembership,TerminateProcess,FreeSid,CloseHandle,CloseHandle,CloseHandle,

2_2_0485841D

Source: C:\Windows\dispci.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_04856FFE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04858192 GetLocalTime,GetSystemDirectoryW,PathAppendW,wsprintfW,

2_2_04858192

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_048557E5 LocalAlloc,GetSystemDefaultLCID,GetTimeZoneInformation,memcpy,NetWkstaGetInfo,memcpy,memcpy,NetApiBufferFree,LocalAlloc,memcpy,LocalFree,LocalFree,

2_2_048557E5

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_04851531 GetVersion,

2_2_04851531

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Mimikatz

Source: Yara match	File source: 11.0.2594.tmp.7ff73cfc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.2594.tmp.7ff73cfc0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	1 Obfuscated Files or Information	11 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	22 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 File Deletion	Security Account Manager	126 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	12 Windows Service	11 Access Token Manipulation	121 Masquerading	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Scheduled Task/Job	12 Windows Service	1 Valid Accounts	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Bootkit	112 Process Injection	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	11 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	2 Indicator Removal	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
download.exe	97%	ReversingLabs	Win32.Ransomware.BadRabbit
download.exe	89%	Virustotal		Browse
download.exe	100%	Avira	TR/Diskcoder.ezxim

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\dispci.exe	100%	Avira	TR/Diskcoder.12354
C:\Windows\cscc.dat	0%	ReversingLabs
C:\Windows\dispci.exe	97%	ReversingLabs	Win32.Ransomware.BadRabbit

Source	Detection	Scanner	Label
http://192.168.2.1/d	0%	Avira URL Cloud	safe
http://192.168.2.1/W	0%	Avira URL Cloud	safe
http://192.168.2.1:80/top	0%	Avira URL Cloud	safe
http://192.168.2.1/;	0%	Avira URL Cloud	safe
http://192.168.2.1/	0%	Avira URL Cloud	safe
http://192.168.2.1/E	0%	Avira URL Cloud	safe
http://diskcryptor.net/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
tse1.mm.bing.net	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://diskcryptor.net/	rundll32.exe, 00000002.00000003.1717628248.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.1717652685.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.1696516164.0000000002C9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.1754801710.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.1696854067.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, dispci.exe, 00000017.00000000.1746771759.0000000000E3E000.00000002.00000001.01000000.00000007.sdmp, dispci.exe.2.dr, cscc.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000020.00000003.1762376215.00000111AFCFF000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.32.dr	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000020.00000003.1762376215.00000111AFCC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.32.dr	false		high
http://192.168.2.1/;	rundll32.exe, 00000002.00000002.1754801710.0000000002CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	download.exe, cscc.dat.2.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000020.00000003.1762376215.00000111AFCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.168.2.1/	rundll32.exe, 00000002.00000002.1754801710.0000000002CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.2.1/d	rundll32.exe, 00000002.00000002.1754801710.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	download.exe, cscc.dat.2.dr	false		high
http://192.168.2.1/E	rundll32.exe, 00000002.00000002.1754801710.0000000002CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.2.1:80/top	rundll32.exe, 00000002.00000002.1763336798.0000000004955000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000020.00000003.1762376215.00000111AFCA3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1762376215.00000111AFCC2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1762376215.00000111AFCF4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1762376215.00000111AFCE8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.32.dr	false		high
http://192.168.2.1/W	rundll32.exe, 00000002.00000002.1754801710.0000000002CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000020.00000003.1762376215.00000111AFCC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.32.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.222.162.32	unknown	United States		35994	AKAMAI-ASUS	true

Private

IP
192.168.2.0
192.168.2.1
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591384
Start date and time:	2025-01-14 23:24:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	download.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@58/8@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 90 Number of non-executed functions: 139
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Connection to analysis system has been lost, crash info: Unknown
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, smss.exe, dwm.exe, csrss.exe, winlogon.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 40.126.32.140, 40.126.32.138, 20.190.160.20, 40.126.32.134, 40.126.32.68, 40.126.32.136, 20.190.160.17, 40.126.32.74, 2.23.240.64, 204.79.197.203, 104.102.63.47, 2.23.227.215, 2.23.227.208, 2.21.65.154, 2.21.65.132, 20.199.58.43, 20.223.35.26, 13.107.246.45
Excluded domains from analysis (whitelisted): otelrules.afd.azureedge.net, www.tm.lg.prod.aadmsa.akadns.net, p-static.bing.trafficmanager.net, iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, cdn.onenote.net.edgekey.net, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, login.live.com, wildcard.weather.microsoft.com.edgekey.net, e16604.g.akamaiedge.net, r.bing.com, arc.trafficmanager.net, prod.fs.microsoft.com.akadns.net, cdn.onenote.net, www.bing.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, e15275.d.akamaiedge.net, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, r.bing.com.edgekey.net, a-0003.a-msedge.net, tile-service.weather.microsoft.com, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, mm-mm.bing.net.trafficmanager.net, e1553.dspg.akamaiedge.net, azureedge-t-prod.trafficmanager.net, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com, api-msn-co
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:25:53	API Interceptor	2x Sleep call for process: rundll32.exe modified
17:25:57	API Interceptor	2x Sleep call for process: svchost.exe modified
22:25:54	Task Scheduler	Run new task: rhaegal path: C:\Windows\system32\cmd.exe s>/C Start "" "C:\Windows\dispci.exe" -id 3065482610 && exit

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
173.222.162.32	Mc.exe	Get hash	malicious	Unknown	Browse
	a.exe	Get hash	malicious	Unknown	Browse
	RgZaLjgCto.exe	Get hash	malicious	Tinba	Browse
	JRDpxoBkBJ.exe	Get hash	malicious	NotPetya	Browse
	smartsscreen.exe	Get hash	malicious	Xmrig	Browse
	java.exe	Get hash	malicious	Tinba	Browse
	java.exe	Get hash	malicious	Tinba	Browse
	java.exe	Get hash	malicious	Tinba	Browse
	p2pWin.exe	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	https://click.e.varietyvibes.buzz/Y3hpZjhhck5JNVlmRWJOUitMVlFVUzdWZlpZQm41V0lZS3E5dlJjWHNLbzhudFR6Qm5uVlZMZ2hqdkVBTmpZZUxFL2tJclNpYnJaTEdFOC9RVU5CZVlkY004d3ZTblF4S0Y5NW82WmdjMFU9	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://iyztciuamr.cfolks.pl/pp	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://metahorizonsfacebooksupport.tempisite.com/italy39	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	http://tetsuyiq.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://informed.deliveryqdmox.top/us/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://9u2pd0kb4iw1eqefiwbh.shoptee.cc/index/user/login.html	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://indexrequestverse.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	phish_alert_sp2_2.0.0.0 (2).eml	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://ledger-recovery.co.uk/	Get hash	malicious	Unknown	Browse	150.171.28.10
s-part-0017.t-0009.t-msedge.net	https://emp.eduyield.com/el?aid=962445be-3c17-11ec-9620-0e45aa61dde5&cid=497&dest=https://google.com/amp/avrancecorp.com/wp-web/Griffinwink/64616b6f74616c796e6e406772696666696e77696e6b2e636f6d/$ZGFrb3&pid=564628&rid=68730789	Get hash	malicious	Unknown	Browse	13.107.246.45
	habHh1BC0L.dll	Get hash	malicious	Wannacry	Browse	13.107.246.45
	19MgUpI9tj.dll	Get hash	malicious	Wannacry	Browse	13.107.246.45
	https://securityalert-corporate.com/click/f288bff9-842d-4e34-8d2d-41ad20e48e9d	Get hash	malicious	Unknown	Browse	13.107.246.45
	hzQNazOx3Z.dll	Get hash	malicious	Wannacry	Browse	13.107.246.45
	eIZi481eP6.dll	Get hash	malicious	Wannacry	Browse	13.107.246.45
	Yx3rRuVx3c.dll	Get hash	malicious	Wannacry	Browse	13.107.246.45
	sUlHfYQxNw.dll	Get hash	malicious	Wannacry	Browse	13.107.246.45
	logitix.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	DHL AWB CUSTOM CLEARANCE.xls	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	172.230.50.2
	XML-702.msi	Get hash	malicious	AteraAgent	Browse	2.23.77.188
	EFT_Payment_Notification_Gheenirrigation.html	Get hash	malicious	HTMLPhisher	Browse	2.19.126.89
	MissedCall_Record_3295935663.html	Get hash	malicious	Unknown	Browse	2.19.126.85
	62.122.184.98 (3).ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	Message.eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	PropostaOrcamentoPdf.msi	Get hash	malicious	AteraAgent	Browse	2.17.190.73
	meth10.elf	Get hash	malicious	Mirai	Browse	104.84.5.44
	meth1.elf	Get hash	malicious	Mirai	Browse	104.84.160.200
	m68k.elf	Get hash	malicious	Unknown	Browse	23.203.64.19

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\cscc.dat	LisectAVT_2403002C_35.exe	Get hash	malicious	Babuk, Mimikatz, TrojanRansom	Browse
	09490699.exe	Get hash	malicious	Unknown	Browse
	09490699.exe	Get hash	malicious	Unknown	Browse
	07bb0738.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine	Browse
	4d44bed6.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine	Browse
	63416c4d.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine	Browse
	irH9zMhZub.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine	Browse
	1jDe7zWnoe.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, Petya, RedLine	Browse
	bpkAAJptGv.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine	Browse
	4W5dQXszUV.exe	Get hash	malicious	Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\e6becf42d407880aefc5533eec57eadd_9e146be9-c76a-4720-bcdb-53011b87bd06

Process:	C:\Windows\dispci.exe
File Type:	data
Category:	dropped
Size (bytes):	50
Entropy (8bit):	1.5212424590621707
Encrypted:	false
SSDEEP:	3:/lvlwjn:wjn
MD5:	4E97ED70D0F9DC5FCF032306DBBD9BDF
SHA1:	F18AB3400BEF916BB2EAE4B2727906A7EA180C31
SHA-256:	591B13F80FD9555F9FA53F1AD3B4CA79E742B89006EACDA54D823F6CF37DDD43
SHA-512:	B4B0C1C4B10F1E9199206E4538ACBF5DA7600023772549C7756C385E9B98B5F0777B4746936D371EECD0A29022E45CE174BA39444F2FC573659D993B711853AE
Malicious:	false
Preview:	........................................user-PC$.

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x331799f1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221603123935326
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	E3C22FDCD63EEB3FF1832CD92F8EFC6D
SHA1:	A26805133296D2B6AA8AB89B91179504153482BD
SHA-256:	C35637D81B3F1DCDF0FE4E3A19BAF250F3158727AA053C4413E1628A91FFD166
SHA-512:	8EC1C9D7B7A37835875062456CC6A6067C8896EEF5F9433DD25A6E941B3474BF1CAD40C9D252AA3548E1AFEB03EF1C629F7CB47642B655914499E8368599B5BA
Malicious:	false
Preview:	3...... .......A.......X\...;...{......................0.!..........{A.9....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................A.9....}...................8e.9....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\DECRYPT.lnk

Process:	C:\Windows\dispci.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Tue Jan 14 21:25:50 2025, mtime=Tue Jan 14 21:25:55 2025, atime=Tue Jan 14 21:25:50 2025, length=142848, window=hide
Category:	dropped
Size (bytes):	725
Entropy (8bit):	4.697714529827064
Encrypted:	false
SSDEEP:	12:8iviLCQm/FMCXXUV5xfKB8VzjAaR6W+IWgL6CNb54VVILYumV:84HdZ0NieFAal+IWt2b54VVyfm
MD5:	529276EEC1D0C0D332420DF43AA5502E
SHA1:	379A9406BC4E2B3715548219A9D65B27829D0EDE
SHA-256:	45E4F67683F8199AEC9AFA6673CFC64DDC09508F3975A3CE451B5E755E4582BF
SHA-512:	25006C4B4C2196A7312DF05BE8CB16E1548F224BC70B9A2469F3A4C72DB54D2CB784F7F7B8BF3C20333A3D86D4EC7C6D0EC977A86197F49D082814426D7772AB
Malicious:	false
Preview:	L..................F.... ...4.GD.f...sGG.f..4.GD.f...............................P.O. .:i.....+00.../C:\...................V.1......Z;...Windows.@......OwH.Z;.....3......................%..W.i.n.d.o.w.s.....`.2......Z:. .dispci.exe..F.......Z:..Z:..............................d.i.s.p.c.i...e.x.e.......D...............-.......C...................C:\Windows\dispci.exe....D.E.C.R.Y.P.T.......\.....\.....\.W.i.n.d.o.w.s.\.d.i.s.p.c.i...e.x.e.........$..................C..B..g..(.#....`.......X.......849224...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..............A...1SPS.XF.L8C....&.m.%................S.-.1.-.5.-.1.8.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Windows\2594.tmp

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62328
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	C7CA77D847F1802502EF3B9228D388E4
SHA1:	80AB09116D877B924DFEC5B6E8EB6D3DDE35869E
SHA-256:	FDEF2F6DA8C5E8002FA5822E8E4FEA278FBA66C22DF9E13B61C8A95C2F9D585F
SHA-512:	B5C23209597ECDDBCDE6CD8E72392721C3C2848385AD3F4C644024979F777FD11F2DD19E763F443C4759BB339B047034997FB06566CE7D4574CF3E4B75F51B7D
Malicious:	true
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\cscc.dat

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210632
Entropy (8bit):	6.677691827536191
Encrypted:	false
SSDEEP:	3072:zCBsPmcx7BTn/irEsrDUxo2vYsWwYEJOXKVviEWuwlVBgzUMqqDLW+z3AHW5:8sPnBT/irETNWiJOXKVvKBgz3qqDL1zt
MD5:	EDB72F4A46C39452D1A5414F7D26454A
SHA1:	08F94684E83A27F2414F439975B7F8A6D61FC056
SHA-256:	0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
SHA-512:	D62A19436ABA8B2D181C065076B4AB54D7D8159D71237F83F1AFF8C3D132A80290AF39A8142708ACB468D78958C64F338BA6AD0CAB9FBAC001A6A0BDDC0E4FAA
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Windows\cscc.dat, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: LisectAVT_2403002C_35.exe, Detection: malicious, Browse Filename: 09490699.exe, Detection: malicious, Browse Filename: 09490699.exe, Detection: malicious, Browse Filename: 07bb0738.exe, Detection: malicious, Browse Filename: 4d44bed6.exe, Detection: malicious, Browse Filename: 63416c4d.exe, Detection: malicious, Browse Filename: irH9zMhZub.exe, Detection: malicious, Browse Filename: 1jDe7zWnoe.exe, Detection: malicious, Browse Filename: bpkAAJptGv.exe, Detection: malicious, Browse Filename: 4W5dQXszUV.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~...~..~.....w.~..x...~..x....~..#...~..#....~..#....~.Rich..~.................PE..d...9.S.........."......\...........0.......................................p............. .................................................0..P....P....... ...............`..t...0d...............................................`..(............................text...WI.......J.................. ..h.rdata...\|...`...~...N..............@..H.data....0......."..................@....pdata....... ......................@..HINIT.........0...................... ....rsrc........P......................@..B.reloc..L....`......................@..B........................................................................................................................................................................................................................................

C:\Windows\dispci.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142848
Entropy (8bit):	6.314365095327337
Encrypted:	false
SSDEEP:	3072:1keK/MwGT0834YW3pvyh8fcl/iL62iL6KK:Sn/MZd4YW3pvyxl/ini
MD5:	B14D8FAF7F0CBCFAD051CEFE5F39645F
SHA1:	AFEEE8B4ACFF87BC469A6F0364A81AE5D60A2ADD
SHA-256:	8EBC97E05C8E1073BDA2EFB6F4D00AD7E789260AFA2C276F0C72740B838A0A93
SHA-512:	F5DCBF3634AEDFE5B8D6255E20015555343ADD5B1BE3801E62A5987E86A3E52495B5CE3156E4F63CF095D0CEDFB63939EAF39BEA379CCAC82A10A4182B8DED22
Malicious:	true
Yara Hits:	Rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, Description: Bad Rabbit Ransomware, Source: C:\Windows\dispci.exe, Author: Christiaan Beek Rule: BadRabbit_Gen, Description: Detects BadRabbit Ransomware, Source: C:\Windows\dispci.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........sR.. R.. R.. I-. v.. I-$ F.. I-. &.. [.9 Q.. [.) C.. R.. ... I-. _.. I- S.. I-' S.. RichR.. ................PE..L...e..Y............................Ug.......0....@.................................a[....@.................................._..........,............................................................[..@............0...............................text...J........................... ..`.rdata..<@...0...B..................@..@.data...,]...........`..............@....rsrc...,............z..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\infpub.dat

Process:	C:\Users\user\Desktop\download.exe
File Type:	data
Category:	dropped
Size (bytes):	410760
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	C4F26ED277B51EF45FA180BE597D96E8
SHA1:	E9EFC622924FB965D4A14BDB6223834D9A9007E7
SHA-256:	14D82A676B63AB046AE94FA5E41F9F69A65DC7946826CB3D74CEA6C030C2F958
SHA-512:	AFC2A8466F106E81D423065B07AED2529CBF690AB4C3E019334F1BEDFB42DC0E0957BE83D860A84B7285BD49285503BFE95A1CF571A678DBC9BDB07789DA928E
Malicious:	true
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.891913976230692
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	download.exe
File size:	441'899 bytes
MD5:	fbbdc39af1139aebba4da004475e8839
SHA1:	de5c8d858e6e41da715dca1c019df0bfb92d32c0
SHA256:	630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
SHA512:	74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
SSDEEP:	12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
TLSH:	199412426729EE92D1E1B8F84093E7CC4BB97B090FB991EF9D993485CC79B8319380D5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&\..G2..G2..G2..?...G2..?...G2......G2......G2..?...G2..G3..G2......G2......G2.Rich.G2.........................PE..L......Y...

File Icon


Icon Hash:	2144b26d6c76b24d

Static PE Info

General

Entrypoint:	0x4012c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x59EC0396 [Sun Oct 22 02:33:58 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e3bda9df66f1f9b2b9b7b068518f2af1

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2016 19:00:00 17/12/2017 18:59:59
Subject Chain	CN=Symantec Corporation, OU=STAR Security Engines, O=Symantec Corporation, L=Mountain View, S=California, C=US
Version:	3
Thumbprint MD5:	015897C25450CE2E9CF3C42B623E4319
Thumbprint SHA-1:	AD96BB64BA36379D2E354660780C2067B81DA2E0
Thumbprint SHA-256:	C5E129D68BEF22CAF45A173328F33C244A3BDF3E959D8EC1F15DE556396247FA
Serial:	0EBFEA68D677B3E26CAB41C33F3E69DE

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
mov eax, 000012ACh
call 00007F327C7E0F28h
mov eax, dword ptr [00408000h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push esi
mov esi, dword ptr [00404004h]
push edi
call esi
mov edi, eax
test edi, edi
je 00007F327C7E0D32h
lea eax, dword ptr [ebp-00001250h]
push eax
mov dword ptr [ebp-00001250h], 00000000h
call esi
push eax
call dword ptr [00404050h]
mov esi, eax
test esi, esi
je 00007F327C7E0D0Eh
cmp dword ptr [ebp-00001250h], 01h
jne 00007F327C7E0BB3h
xor eax, eax
lea ebx, dword ptr [ebx+00000000h]
movzx ecx, word ptr [eax+00406CF0h]
mov word ptr [ebp+eax-0000124Ch], cx
add eax, 02h
test cx, cx
jne 00007F327C7E0B7Bh
jmp 00007F327C7E0BE8h
mov eax, dword ptr [esi]
push eax
push edi
call dword ptr [00404060h]
mov ecx, dword ptr [esi]
add esp, 08h
lea esi, dword ptr [ecx+02h]
jmp 00007F327C7E0B95h
lea ecx, dword ptr [ecx+00h]
mov dx, word ptr [ecx]
add ecx, 02h
test dx, dx
jne 00007F327C7E0B87h
sub ecx, esi
sar ecx, 1
cmp word ptr [eax+ecx*2], 0022h
lea eax, dword ptr [eax+ecx*2]
jne 00007F327C7E0B95h
add eax, 02h
cmp word ptr [eax], 0020h
jne 00007F327C7E0B95h
add eax, 02h
lea edx, dword ptr [ebp-0000124Ch]
sub edx, eax
lea ecx, dword ptr [ecx+00h]
movzx ecx, word ptr [eax]
mov word ptr [edx+eax], cx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2013 UPD5 build 40629
[ASM] VS2013 UPD5 build 40629
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d8c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9000	0x7088	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x689a3	0x3488
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11000	0x1a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4000	0x74	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2ed3	0x3000	098c323b1a59bcf15c1feb8055e58931	False	0.6101888020833334	data	6.5841037789243835	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4000	0x302a	0x3200	9cc3629beb9d1f37932d860de2e3a4f5	False	0.81	data	7.1772588683417196	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8000	0x33c	0x200	4e5d61b2bd73632f0225e39a2e2c5144	False	0.048828125	data	0.1833387916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9000	0x7088	0x7200	256c5e23a9ad8a276128f84017b2d79d	False	0.16615268640350878	data	4.204085780982396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11000	0x24e	0x400	26cd68101ade4e5f70ab3cd5f35e0ad5	False	0.41796875	data	3.293138685594118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x9254	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.20309168443496803
RT_ICON	0xa0fc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.21931407942238268
RT_ICON	0xa9a4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.2203757225433526
RT_ICON	0xaf0c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.19230769230769232
RT_ICON	0xbfb4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.14014522821576764
RT_ICON	0xe55c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.19230769230769232
RT_ICON	0xf604	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.39893617021276595
RT_GROUP_ICON	0xfa6c	0x68	data	English	United States	0.6826923076923077
RT_VERSION	0xfad4	0x450	data	English	United States	0.37681159420289856
RT_MANIFEST	0xff24	0x161	ASCII text, with CRLF line terminators	English	United States	0.5495750708215298

Imports

DLL	Import
KERNEL32.dll	ExitProcess, GetCommandLineW, GetFileSize, CreateProcessW, HeapAlloc, HeapFree, GetModuleHandleW, GetProcessHeap, WriteFile, GetSystemDirectoryW, ReadFile, GetModuleFileNameW, CreateFileW, lstrcatW, CloseHandle, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, SetUnhandledExceptionFilter
USER32.dll	wsprintfW
SHELL32.dll	CommandLineToArgvW
msvcrt.dll	wcsstr, memcpy, free, malloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 23:25:54.175013065 CET	49749	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:54.179801941 CET	445	49749	173.222.162.32	192.168.2.4
Jan 14, 2025 23:25:54.179853916 CET	49749	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:54.181539059 CET	49749	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:54.188220024 CET	445	49749	173.222.162.32	192.168.2.4
Jan 14, 2025 23:25:54.204817057 CET	49752	80	192.168.2.4	192.168.2.1
Jan 14, 2025 23:25:54.247684956 CET	49753	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:54.252549887 CET	445	49753	173.222.162.32	192.168.2.4
Jan 14, 2025 23:25:54.252646923 CET	49753	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:54.252840996 CET	49753	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:54.257594109 CET	445	49753	173.222.162.32	192.168.2.4
Jan 14, 2025 23:25:55.137398005 CET	49675	443	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:55.215500116 CET	49752	80	192.168.2.4	192.168.2.1
Jan 14, 2025 23:25:57.215562105 CET	49752	80	192.168.2.4	192.168.2.1
Jan 14, 2025 23:25:58.439310074 CET	49672	443	192.168.2.4	173.222.162.32
Jan 14, 2025 23:25:58.539627075 CET	49753	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:26:15.560993910 CET	445	49749	173.222.162.32	192.168.2.4
Jan 14, 2025 23:26:15.561197042 CET	49749	445	192.168.2.4	173.222.162.32
Jan 14, 2025 23:26:15.561197996 CET	49749	445	192.168.2.4	173.222.162.32

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 23:26:14.503911018 CET	61568	53	192.168.2.4	1.1.1.1
Jan 14, 2025 23:28:14.154046059 CET	54526	53	192.168.2.4	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 14, 2025 23:25:54.204912901 CET	192.168.2.1	192.168.2.4	8279	(Port unreachable)	Destination Unreachable
Jan 14, 2025 23:25:55.215593100 CET	192.168.2.1	192.168.2.4	8279	(Port unreachable)	Destination Unreachable
Jan 14, 2025 23:25:57.215662003 CET	192.168.2.1	192.168.2.4	8279	(Port unreachable)	Destination Unreachable
Jan 14, 2025 23:26:12.093116999 CET	192.168.2.4	192.168.2.1	8270	(Port unreachable)	Destination Unreachable
Jan 14, 2025 23:27:32.165023088 CET	192.168.2.4	192.168.2.1	8270	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 23:26:14.503911018 CET	192.168.2.4	1.1.1.1	0x3b4	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 23:28:14.154046059 CET	192.168.2.4	1.1.1.1	0x16e6	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 23:26:14.510740995 CET	1.1.1.1	192.168.2.4	0x3b4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 23:26:46.625550032 CET	1.1.1.1	192.168.2.4	0x92f0	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 23:26:46.625550032 CET	1.1.1.1	192.168.2.4	0x92f0	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 14, 2025 23:28:14.160909891 CET	1.1.1.1	192.168.2.4	0x16e6	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 23:28:14.160909891 CET	1.1.1.1	192.168.2.4	0x16e6	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Jan 14, 2025 23:28:14.160909891 CET	1.1.1.1	192.168.2.4	0x16e6	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	17:25:50
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\download.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\download.exe"
Imagebase:	0xc00000
File size:	441'899 bytes
MD5 hash:	FBBDC39AF1139AEBBA4DA004475E8839
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	17:25:50
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	17:25:50
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
Imagebase:	0xc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, Description: Bad Rabbit Ransomware, Source: 00000002.00000003.1717628248.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, Author: Christiaan Beek
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:25:50
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c schtasks /Delete /F /TN rhaegal
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	17:25:50
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	17:25:50
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Delete /F /TN rhaegal
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3065482610 && exit"
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	11
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\2594.tmp
Wow64 process (32bit):	false
Commandline:	"C:\Windows\2594.tmp" \\.\pipe\{D8F326F0-A034-43D5-AD41-3DA9EEB64FB1}
Imagebase:	0x7ff73cfc0000
File size:	62'328 bytes
MD5 hash:	347AC3B6B791054DE3E5720A7144A977
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	12
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	17:25:52
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:43:00
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl Setup
Imagebase:	0xae0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl System
Imagebase:	0xae0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl Security
Imagebase:	0xae0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl Application
Imagebase:	0xae0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	17:25:53
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\fsutil.exe
Wow64 process (32bit):	true
Commandline:	fsutil usn deletejournal /D C:
Imagebase:	0x4d0000
File size:	167'440 bytes
MD5 hash:	452CA7574A1B2550CD9FF83DDBE87463
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	17:25:54
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /C Start "" "C:\Windows\dispci.exe" -id 3065482610 && exit
Imagebase:	0x7ff603690000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	17:25:55
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	17:25:55
Start date:	14/01/2025
Path:	C:\Windows\dispci.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\dispci.exe" -id 3065482610
Imagebase:	0xdf0000
File size:	142'848 bytes
MD5 hash:	B14D8FAF7F0CBCFAD051CEFE5F39645F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, Description: Bad Rabbit Ransomware, Source: C:\Windows\dispci.exe, Author: Christiaan Beek Rule: BadRabbit_Gen, Description: Detects BadRabbit Ransomware, Source: C:\Windows\dispci.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 97%, ReversingLabs
Has exited:	true

Target ID:	24
Start time:	17:25:55
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	17:25:55
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c schtasks /Delete /F /TN rhaegal
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	17:25:55
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	17:25:56
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Delete /F /TN rhaegal
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	17:25:56
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c schtasks /Delete /F /TN drogon
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	17:25:56
Start date:	14/01/2025
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	"LogonUI.exe" /flags:0x4 /state0:0xa3f61055 /state1:0x41c64e6d
Imagebase:	0x7ff75ff10000
File size:	13'824 bytes
MD5 hash:	893144FE49AA16124B5BD3034E79BBC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	17:25:56
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	17:25:56
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Delete /F /TN drogon
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	17:25:56
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	37
Start time:	17:25:58
Start date:	14/01/2025
Path:	C:\Windows\System32\cdd.dll
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	267'264 bytes
MD5 hash:	9B684213A399B4E286982BDAD6CF3D07
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	17:25:58
Start date:	14/01/2025
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	"LogonUI.exe" /flags:0x2 /state0:0xa3f6c855 /state1:0x41c64e6d
Imagebase:	0x7ff75ff10000
File size:	13'824 bytes
MD5 hash:	893144FE49AA16124B5BD3034E79BBC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	17:25:58
Start date:	14/01/2025
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"fontdrvhost.exe"
Imagebase:	0x7ff72c440000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	44
Start time:	17:26:00
Start date:	14/01/2025
Path:	C:\Windows\System32\cdd.dll
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	267'264 bytes
MD5 hash:	9B684213A399B4E286982BDAD6CF3D07
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	45
Start time:	17:26:00
Start date:	14/01/2025
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"fontdrvhost.exe"
Imagebase:	0x7ff72c440000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	46
Start time:	17:26:00
Start date:	14/01/2025
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	"LogonUI.exe" /flags:0x2 /state0:0xa3f74055 /state1:0x41c64e6d
Imagebase:	0x7ff75ff10000
File size:	13'824 bytes
MD5 hash:	893144FE49AA16124B5BD3034E79BBC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	52
Start time:	17:26:09
Start date:	14/01/2025
Path:	C:\Windows\System32\cdd.dll
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	267'264 bytes
MD5 hash:	9B684213A399B4E286982BDAD6CF3D07
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	53
Start time:	17:26:10
Start date:	14/01/2025
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	"LogonUI.exe" /flags:0x2 /state0:0xa3f04055 /state1:0x41c64e6d
Imagebase:	0x7ff75ff10000
File size:	13'824 bytes
MD5 hash:	893144FE49AA16124B5BD3034E79BBC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	55
Start time:	17:26:10
Start date:	14/01/2025
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"fontdrvhost.exe"
Imagebase:	0x7ff72c440000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true