Overview
overview
10Static
static
3windows-ma...00.exe
windows7-x64
windows-ma...00.exe
windows10-2004-x64
windows-ma...fy.exe
windows7-x64
8windows-ma...fy.exe
windows10-2004-x64
8windows-ma...or.exe
windows7-x64
windows-ma...or.exe
windows10-2004-x64
windows-ma...XT.vbs
windows7-x64
1windows-ma...XT.vbs
windows10-2004-x64
1windows-ma...ck.exe
windows7-x64
6windows-ma...ck.exe
windows10-2004-x64
7windows-ma....0.exe
windows7-x64
windows-ma....0.exe
windows10-2004-x64
windows-ma...p).exe
windows7-x64
10windows-ma...p).exe
windows10-2004-x64
Analysis
-
max time kernel
239s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
windows-malware-master/000/000.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
windows-malware-master/000/000.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
windows-malware-master/Bonzify/Bonzify.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
windows-malware-master/Bonzify/Bonzify.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
windows-malware-master/BossDaMajor/BossDaMajor.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
windows-malware-master/BossDaMajor/BossDaMajor.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
windows-malware-master/ILOVEYOU/LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
windows-malware-master/ILOVEYOU/LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
windows-malware-master/MEMZ/geometry dash auto speedhack.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
windows-malware-master/MEMZ/geometry dash auto speedhack.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
windows-malware-master/MrsMajor 2.0/MrsMajor2.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
windows-malware-master/MrsMajor 2.0/MrsMajor2.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
Resource
win10v2004-20240508-en
Errors
General
-
Target
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
-
Size
57.9MB
-
MD5
063ea883f8c67d3bb22e0a465136ca4c
-
SHA1
3a168a9153ee32b86d9a5411b0af13846c55ee1d
-
SHA256
3b64ce283febf3207dd20c99fc53de65b07044231eb544c4c41de374a2571c5c
-
SHA512
2dd6be23a5af8c458b94eeb5a4e83fc8cacb3fd2c2566b5682eee286c01726dca90db3d9b4e218eeded9b0c9bce8ba3c9ca9cc497e3a57aab580633a038e4b74
-
SSDEEP
1572864:aj6L5PLk/mBCSyKOYl39GFoFEujFMm+B997DaNHN1oS72fnD9hRzZ01tO0DpvrvI:i6cSzV9GCFEujFMm+B997DaNHN1oS72X
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables Task Manager via registry modification
-
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WinXP.Horror.Destructive (Created By WobbyChip).exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process File opened for modification \??\PhysicalDrive0 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Modifies Control Panel 2 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Mouse WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Mouse\SwapMouseButtons = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exepid process 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AUDIODG.EXEWinXP.Horror.Destructive (Created By WobbyChip).exedescription pid process Token: 33 928 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 928 AUDIODG.EXE Token: SeDebugPrivilege 2572 WinXP.Horror.Destructive (Created By WobbyChip).exe -
System policy modification 1 TTPs 5 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows-malware-master\WinXP Horror Edition\WinXP.Horror.Destructive (Created By WobbyChip).exe"C:\Users\Admin\AppData\Local\Temp\windows-malware-master\WinXP Horror Edition\WinXP.Horror.Destructive (Created By WobbyChip).exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ac 0x4dc1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2572-0-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/2572-1-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-2-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-3-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-9-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-14-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-15-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-16-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-19-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-20-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-21-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-22-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-23-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-24-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/2572-25-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB