Overview
overview
10Static
static
3windows-ma...00.exe
windows7-x64
windows-ma...00.exe
windows10-2004-x64
windows-ma...fy.exe
windows7-x64
8windows-ma...fy.exe
windows10-2004-x64
8windows-ma...or.exe
windows7-x64
windows-ma...or.exe
windows10-2004-x64
windows-ma...XT.vbs
windows7-x64
1windows-ma...XT.vbs
windows10-2004-x64
1windows-ma...ck.exe
windows7-x64
6windows-ma...ck.exe
windows10-2004-x64
7windows-ma....0.exe
windows7-x64
windows-ma....0.exe
windows10-2004-x64
windows-ma...p).exe
windows7-x64
10windows-ma...p).exe
windows10-2004-x64
Analysis
-
max time kernel
311s -
max time network
316s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
windows-malware-master/000/000.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
windows-malware-master/000/000.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
windows-malware-master/Bonzify/Bonzify.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
windows-malware-master/Bonzify/Bonzify.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
windows-malware-master/BossDaMajor/BossDaMajor.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
windows-malware-master/BossDaMajor/BossDaMajor.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
windows-malware-master/ILOVEYOU/LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
windows-malware-master/ILOVEYOU/LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
windows-malware-master/MEMZ/geometry dash auto speedhack.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
windows-malware-master/MEMZ/geometry dash auto speedhack.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
windows-malware-master/MrsMajor 2.0/MrsMajor2.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
windows-malware-master/MrsMajor 2.0/MrsMajor2.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
Resource
win10v2004-20240508-en
General
-
Target
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
-
Size
57.9MB
-
MD5
063ea883f8c67d3bb22e0a465136ca4c
-
SHA1
3a168a9153ee32b86d9a5411b0af13846c55ee1d
-
SHA256
3b64ce283febf3207dd20c99fc53de65b07044231eb544c4c41de374a2571c5c
-
SHA512
2dd6be23a5af8c458b94eeb5a4e83fc8cacb3fd2c2566b5682eee286c01726dca90db3d9b4e218eeded9b0c9bce8ba3c9ca9cc497e3a57aab580633a038e4b74
-
SSDEEP
1572864:aj6L5PLk/mBCSyKOYl39GFoFEujFMm+B997DaNHN1oS72fnD9hRzZ01tO0DpvrvI:i6cSzV9GCFEujFMm+B997DaNHN1oS72X
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables Task Manager via registry modification
-
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process File opened for modification \??\PhysicalDrive0 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Modifies Control Panel 2 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Mouse\SwapMouseButtons = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Mouse WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exepid process 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe 1452 WinXP.Horror.Destructive (Created By WobbyChip).exe -
System policy modification 1 TTPs 5 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows-malware-master\WinXP Horror Edition\WinXP.Horror.Destructive (Created By WobbyChip).exe"C:\Users\Admin\AppData\Local\Temp\windows-malware-master\WinXP Horror Edition\WinXP.Horror.Destructive (Created By WobbyChip).exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-0-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1452-1-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-2-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1452-3-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-4-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-15-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-16-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-17-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-21-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-22-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-23-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-24-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-25-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-26-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-27-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-28-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-29-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-30-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-31-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-32-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-33-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-34-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/1452-35-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB