Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AdvancedRAT' = '"<Full path to file>"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSystem' = '%APPDATA%\WindowsSystem\winsys.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsSystem' = '%APPDATA%\WindowsSystem\winsys.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSystem' = '%APPDATA%\WindowsSystem\winsys.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSystemWatchdog' = '%APPDATA%\WindowsSystem\watchdog.bat'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsSystemWatchdog' = '%APPDATA%\WindowsSystem\watchdog.bat'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSystemWatchdog' = '%APPDATA%\WindowsSystem\watchdog.bat'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowssystem
- <SYSTEM32>\tasks\windowssystemdaily
- <SYSTEM32>\tasks\windowssystemstartup
- <SYSTEM32>\tasks\windowssystemwatchdog
- <SYSTEM32>\tasks\windowssystemhighfreq
- <SYSTEM32>\tasks\windowssystemidle
- <SYSTEM32>\tasks\windowssystemboot
- <SYSTEM32>\tasks\windowssystempswatchdog
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsSystemService] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsSystemService] 'ImagePath' = '%APPDATA%\WindowsSystem\winsys.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsSystemMonitor] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsSystemMonitor] 'ImagePath' = '<SYSTEM32>\winsys.exe'
Creates the following services
- 'WindowsSystemService' %APPDATA%\WindowsSystem\winsys.exe
- 'WindowsSystemMonitor' <SYSTEM32>\winsys.exe
- 'WindowsSystemService' <SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\schtasks.exe
Modifies file system
Creates the following files
- %TEMP%\onefile_5048_134062397848607895\malware.dll
- %TEMP%\onefile_5048_134062397848607895\_asyncio.pyd
- %TEMP%\onefile_5048_134062397848607895\_brotli.pyd
- %TEMP%\onefile_5048_134062397848607895\_bz2.pyd
- %TEMP%\onefile_5048_134062397848607895\_cffi_backend.pyd
- %TEMP%\onefile_5048_134062397848607895\_ctypes.pyd
- %TEMP%\onefile_5048_134062397848607895\_decimal.pyd
- %TEMP%\onefile_5048_134062397848607895\_elementtree.pyd
- %TEMP%\onefile_5048_134062397848607895\_hashlib.pyd
- %TEMP%\onefile_5048_134062397848607895\_lzma.pyd
- %TEMP%\onefile_5048_134062397848607895\_multiprocessing.pyd
- %TEMP%\onefile_5048_134062397848607895\_overlapped.pyd
- %TEMP%\onefile_5048_134062397848607895\_queue.pyd
- %TEMP%\onefile_5048_134062397848607895\_socket.pyd
- %TEMP%\onefile_5048_134062397848607895\_sqlite3.pyd
- %TEMP%\onefile_5048_134062397848607895\_ssl.pyd
- %TEMP%\onefile_5048_134062397848607895\_tkinter.pyd
- %TEMP%\onefile_5048_134062397848607895\_uuid.pyd
- %TEMP%\onefile_5048_134062397848607895\_win32sysloader.pyd
- %TEMP%\onefile_5048_134062397848607895\_wmi.pyd
- %TEMP%\onefile_5048_134062397848607895\libcrypto-3.dll
- %TEMP%\onefile_5048_134062397848607895\libffi-8.dll
- %TEMP%\onefile_5048_134062397848607895\libssl-3.dll
- %TEMP%\onefile_5048_134062397848607895\mfc140u.dll
- %TEMP%\onefile_5048_134062397848607895\perfmon.pyd
- %TEMP%\onefile_5048_134062397848607895\pyexpat.pyd
- %TEMP%\onefile_5048_134062397848607895\python3.dll
- %TEMP%\onefile_5048_134062397848607895\python312.dll
- %TEMP%\onefile_5048_134062397848607895\pythoncom312.dll
- %TEMP%\onefile_5048_134062397848607895\pywintypes312.dll
- %TEMP%\onefile_5048_134062397848607895\select.pyd
- %TEMP%\onefile_5048_134062397848607895\servicemanager.pyd
- %TEMP%\onefile_5048_134062397848607895\sqlite3.dll
- %TEMP%\onefile_5048_134062397848607895\tcl86t.dll
- %TEMP%\onefile_5048_134062397848607895\tk86t.dll
- %TEMP%\onefile_5048_134062397848607895\unicodedata.pyd
- %TEMP%\onefile_5048_134062397848607895\vcruntime140.dll
- %TEMP%\onefile_5048_134062397848607895\vcruntime140_1.dll
- %TEMP%\onefile_5048_134062397848607895\win32api.pyd
- %TEMP%\onefile_5048_134062397848607895\win32console.pyd
- %TEMP%\onefile_5048_134062397848607895\win32crypt.pyd
- %TEMP%\onefile_5048_134062397848607895\win32event.pyd
- %TEMP%\onefile_5048_134062397848607895\win32evtlog.pyd
- %TEMP%\onefile_5048_134062397848607895\win32gui.pyd
- %TEMP%\onefile_5048_134062397848607895\win32service.pyd
- %TEMP%\onefile_5048_134062397848607895\win32ui.pyd
- %TEMP%\onefile_5048_134062397848607895\winsound.pyd
- %TEMP%\onefile_5048_134062397848607895\zlib1.dll
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_salsa20.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_aes.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_aesni.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_cbc.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_cfb.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_ctr.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_ecb.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_ocb.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\cipher\_raw_ofb.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_blake2s.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_md5.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_sha1.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_sha224.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_sha256.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_sha384.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_sha512.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_ghash_clmul.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_ghash_portable.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\hash\_keccak.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\protocol\_scrypt.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\util\_cpuid_c.pyd
- %TEMP%\onefile_5048_134062397848607895\crypto\util\_strxor.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_salsa20.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_aes.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_aesni.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_cbc.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_cfb.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_ctr.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_ecb.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_eksblowfish.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_ocb.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\cipher\_raw_ofb.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_blake2s.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_md5.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_sha1.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_sha224.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_sha256.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_sha384.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_sha512.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_ghash_clmul.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_ghash_portable.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\hash\_keccak.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\protocol\_scrypt.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\util\_cpuid_c.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptodome\util\_strxor.pyd
- %TEMP%\onefile_5048_134062397848607895\pil\_imaging.pyd
- %TEMP%\onefile_5048_134062397848607895\pil\_imagingcms.pyd
- %TEMP%\onefile_5048_134062397848607895\pil\_imagingft.pyd
- %TEMP%\onefile_5048_134062397848607895\pil\_imagingmath.pyd
- %TEMP%\onefile_5048_134062397848607895\pil\_imagingtk.pyd
- %TEMP%\onefile_5048_134062397848607895\pil\_webp.pyd
- %TEMP%\onefile_5048_134062397848607895\certifi\cacert.pem
- %TEMP%\onefile_5048_134062397848607895\charset_normalizer\md.pyd
- %TEMP%\onefile_5048_134062397848607895\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_5048_134062397848607895\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_5048_134062397848607895\cv2\cv2.pyd
- %TEMP%\onefile_5048_134062397848607895\cv2\opencv_videoio_ffmpeg4120_64.dll
- %TEMP%\onefile_5048_134062397848607895\lz4\_version.pyd
- %TEMP%\onefile_5048_134062397848607895\lz4\block\_block.pyd
- %TEMP%\onefile_5048_134062397848607895\multidict\_multidict.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\_core\_multiarray_tests.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\_core\_multiarray_umath.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\fft\_pocketfft_umath.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\linalg\_umath_linalg.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_bounded_integers.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_common.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_generator.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_mt19937.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_pcg64.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_philox.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\_sfc64.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\bit_generator.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy\random\mtrand.pyd
- %TEMP%\onefile_5048_134062397848607895\numpy.libs\libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
- %TEMP%\onefile_5048_134062397848607895\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
- %TEMP%\onefile_5048_134062397848607895\propcache\_helpers_c.pyd
- %TEMP%\onefile_5048_134062397848607895\psutil\_psutil_windows.pyd
- %TEMP%\onefile_5048_134062397848607895\yarl\_quoting_c.pyd
- %TEMP%\onefile_5048_134062397848607895\zstandard\_cffi.pyd
- %TEMP%\onefile_5048_134062397848607895\zstandard\backend_c.pyd
- %TEMP%\gen_py\3.12\__init__.py
- %TEMP%\gen_py\3.12\dicts.dat
- %APPDATA%\windowssystem\winsys.exe
- <SYSTEM32>\winsys.exe
- %APPDATA%\windowssystem\watchdog.bat
- %APPDATA%\windowssystem\watchdog.ps1
- <SYSTEM32>\windowspowershell\v1.0\theme.json
- %TEMP%\efb6eawb
- %TEMP%\tmpxxkjccxh.sqlite
- %TEMP%\tmp4ipsnfed.sqlite
- %TEMP%\tmpdmrumf50.sqlite
- %TEMP%\tmp4ipsnfed.sqlite-shm
- %TEMP%\tmpdmrumf50.sqlite-shm
- %TEMP%\tmpxxkjccxh.sqlite-shm
- %TEMP%\tmpbqc211e5.sqlite
- %TEMP%\tmpbqc211e5.sqlite-shm
- %TEMP%\tmpl9hv1z9q.sqlite
- %TEMP%\tmpl9hv1z9q.sqlite-shm
- %TEMP%\tmpklk1uztk.sqlite
- %TEMP%\tmpklk1uztk.sqlite-shm
- %WINDIR%\temp\onefile_1316_134062398620591457\malware.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\_asyncio.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_brotli.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_bz2.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_cffi_backend.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_ctypes.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_decimal.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_elementtree.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_hashlib.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_lzma.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_multiprocessing.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_overlapped.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_queue.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_socket.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_sqlite3.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_ssl.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_tkinter.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_uuid.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_win32sysloader.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\_wmi.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\libcrypto-3.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\libffi-8.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\libssl-3.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\mfc140u.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\perfmon.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pyexpat.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\python3.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\python312.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\pythoncom312.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\pywintypes312.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\select.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\servicemanager.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\sqlite3.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\tcl86t.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\tk86t.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\unicodedata.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\vcruntime140.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\vcruntime140_1.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\win32api.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32console.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32crypt.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32event.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32evtlog.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32gui.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32service.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\win32ui.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\winsound.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\zlib1.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_salsa20.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_aes.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_aesni.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_cbc.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_cfb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_ctr.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_ecb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_eksblowfish.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_ocb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\cipher\_raw_ofb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_blake2s.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_md5.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_sha1.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_sha224.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_sha256.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_sha384.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_sha512.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_ghash_clmul.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_ghash_portable.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\hash\_keccak.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\protocol\_scrypt.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\util\_cpuid_c.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\crypto\util\_strxor.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_salsa20.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_aes.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_aesni.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_cbc.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_cfb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_ctr.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_ecb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_eksblowfish.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_ocb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\cipher\_raw_ofb.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_blake2s.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_md5.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_sha1.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_sha224.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_sha256.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_sha384.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_sha512.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_ghash_clmul.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_ghash_portable.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\hash\_keccak.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\protocol\_scrypt.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\util\_cpuid_c.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptodome\util\_strxor.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pil\_imaging.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pil\_imagingcms.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pil\_imagingft.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pil\_imagingmath.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pil\_imagingtk.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\pil\_webp.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\certifi\cacert.pem
- %WINDIR%\temp\onefile_1316_134062398620591457\charset_normalizer\md.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\charset_normalizer\md__mypyc.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cryptography\hazmat\bindings\_rust.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cv2\cv2.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\cv2\opencv_videoio_ffmpeg4120_64.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\lz4\_version.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\lz4\block\_block.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\multidict\_multidict.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\_core\_multiarray_tests.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\_core\_multiarray_umath.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\fft\_pocketfft_umath.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\linalg\_umath_linalg.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_bounded_integers.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_common.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_generator.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_mt19937.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_pcg64.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_philox.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\_sfc64.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\bit_generator.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy\random\mtrand.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy.libs\libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
- %WINDIR%\temp\onefile_1316_134062398620591457\propcache\_helpers_c.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\psutil\_psutil_windows.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\yarl\_quoting_c.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\zstandard\_cffi.pyd
- %WINDIR%\temp\onefile_1316_134062398620591457\zstandard\backend_c.pyd
- %TEMP%\tmpx2p15s9o.sqlite
- %TEMP%\tmp0zlroqkv.sqlite
- %TEMP%\tmpx2p15s9o.sqlite-shm
- %TEMP%\tmp0zlroqkv.sqlite-shm
- %TEMP%\tmpt4_ll5co.sqlite
- %TEMP%\tmpt4_ll5co.sqlite-shm
- %WINDIR%\temp\gen_py\3.12\__init__.py
- %WINDIR%\temp\gen_py\3.12\dicts.dat
- <SYSTEM32>\config\systemprofile\appdata\roaming\windowssystem\winsys.exe
- <SYSTEM32>\config\systemprofile\appdata\roaming\windowssystem\watchdog.bat
- <SYSTEM32>\config\systemprofile\appdata\roaming\windowssystem\watchdog.ps1
- <SYSTEM32>\theme.json
- %TEMP%\tmp48dz69pp.sqlite
- %TEMP%\tmp48dz69pp.sqlite-shm
- %TEMP%\tmp9cs8_eq0.sqlite
- %TEMP%\tmp9cs8_eq0.sqlite-shm
- %TEMP%\tmp80m_tcjh.sqlite
- %TEMP%\tmp80m_tcjh.sqlite-shm
- %TEMP%\tmpg61ysv2a.sqlite-shm
- %TEMP%\tmpbh9d8cw2.sqlite-shm
- %TEMP%\tmpjnvxsfne.sqlite-shm
- %TEMP%\tmpq9jznrj4.sqlite-shm
- %TEMP%\tmpz77mey1i.sqlite-shm
- %TEMP%\tmpd7rtsb33.sqlite-shm
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\winsys.exe
- %APPDATA%\windowssystem\winsys.exe
- <SYSTEM32>\config\systemprofile\appdata\roaming\windowssystem\winsys.exe
Deletes following files that it created itself
- %TEMP%\efb6eawb
- %TEMP%\tmpxxkjccxh.sqlite-shm
- %TEMP%\tmpxxkjccxh.sqlite
- %TEMP%\tmpdmrumf50.sqlite-shm
- %TEMP%\tmpdmrumf50.sqlite
- %TEMP%\tmp4ipsnfed.sqlite-shm
- %TEMP%\tmp4ipsnfed.sqlite
- %TEMP%\tmpbqc211e5.sqlite-shm
- %TEMP%\tmpbqc211e5.sqlite
- %TEMP%\tmpl9hv1z9q.sqlite-shm
- %TEMP%\tmpl9hv1z9q.sqlite
- %TEMP%\tmpklk1uztk.sqlite-shm
- %TEMP%\tmpklk1uztk.sqlite
- %TEMP%\tmpx2p15s9o.sqlite-shm
- %TEMP%\tmpx2p15s9o.sqlite
- %TEMP%\tmp0zlroqkv.sqlite-shm
- %TEMP%\tmp0zlroqkv.sqlite
- %TEMP%\tmpt4_ll5co.sqlite-shm
- %TEMP%\tmpt4_ll5co.sqlite
- <SYSTEM32>\winsys.exe
- %TEMP%\tmp48dz69pp.sqlite-shm
- %TEMP%\tmp48dz69pp.sqlite
- %TEMP%\tmp9cs8_eq0.sqlite-shm
- %TEMP%\tmp9cs8_eq0.sqlite
- %TEMP%\tmp80m_tcjh.sqlite-shm
- %TEMP%\tmp80m_tcjh.sqlite
- %TEMP%\tmpg61ysv2a.sqlite-shm
- %TEMP%\tmpbh9d8cw2.sqlite-shm
- %TEMP%\tmpjnvxsfne.sqlite-shm
- %TEMP%\tmpq9jznrj4.sqlite-shm
- %TEMP%\tmpz77mey1i.sqlite-shm
- %TEMP%\tmpd7rtsb33.sqlite-shm
Substitutes the following files
- <SYSTEM32>\winsys.exe
Network activity
Connects to
- 'localhost':49699
- 'localhost':49701
- 'ap#.#pify.org':443
- 'ip##pi.com':80
- 'fi#.##t-hosting.net':21478
- 'localhost':49731
- 'localhost':49733
TCP
HTTP GET requests
HTTP POST requests
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
- DNS ASK fi#.##t-hosting.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\windowssystem\winsys.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystem" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onlogon /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystem" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onlogon /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemDaily" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc daily /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemDaily" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc daily /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemStartup" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onstart /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemStartup" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onstart /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemWatchdog" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc minute /mo 5 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemWatchdog" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc minute /mo 5 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemHighFreq" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc minute /mo 1 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemHighFreq" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc minute /mo 1 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemIdle" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onidle /i 1 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemIdle" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onidle /i 1 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemBoot" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onstart /delay 0000:30 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemBoot" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onstart /delay 0000:30 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSWatchdog" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "%APPDATA%\WindowsSystem\watchdog.ps1"" /sc minute /mo 10 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemPSWatchdog" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "%APPDATA%\WindowsSystem\watchdog.ps1"" /sc minute /mo 10 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSDirect" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Process -FilePath "%APPDATA%\WindowsSystem\winsys.exe" -WindowSt...
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemPSDirect" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Process -FilePath "%APPDATA%\WindowsSystem\winsys.exe" -WindowStyle Hidden"" ...
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSMonitor" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-Process -Name "winsys" -ErrorAction SilentlyContinue | Where-Obje...
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemPSMonitor" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-Process -Name "winsys" -ErrorAction SilentlyContinue
- '<SYSTEM32>\cmd.exe' /c "sc create "WindowsSystemService" binPath="%APPDATA%\WindowsSystem\winsys.exe" start=auto"
- '<SYSTEM32>\sc.exe' create "WindowsSystemService" binPath="%APPDATA%\WindowsSystem\winsys.exe" start=auto
- '<SYSTEM32>\cmd.exe' /c "sc create "WindowsSystemMonitor" binPath="<SYSTEM32>\winsys.exe" start=auto"
- '<SYSTEM32>\sc.exe' create "WindowsSystemMonitor" binPath="<SYSTEM32>\winsys.exe" start=auto
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystem" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onlogon /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystem" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onlogon /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemDaily" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc daily /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemDaily" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc daily /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemStartup" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onstart /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemStartup" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onstart /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemWatchdog" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc minute /mo 5 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemWatchdog" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc minute /mo 5 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemHighFreq" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc minute /mo 1 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemHighFreq" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc minute /mo 1 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemIdle" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onidle /i 1 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemIdle" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onidle /i 1 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemBoot" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onstart /delay 0000:30 /ru System /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemBoot" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onstart /delay 0000:30 /ru System /f
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSWatchdog" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\watchdog....
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemPSWatchdog" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\watchdog.ps1"" /sc min...
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSDirect" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Process -FilePath "<SYSTEM32>\config\systemprofile\AppData\Roami...
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSystemPSDirect" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Process -FilePath "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSys...
- '<SYSTEM32>\cmd.exe' /c "sc create "WindowsSystemService" binPath="<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" start=auto"
- '<SYSTEM32>\sc.exe' create "WindowsSystemService" binPath="<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" start=auto
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystem" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onlogon /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemDaily" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc daily /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemStartup" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onstart /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemWatchdog" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc minute /mo 5 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemHighFreq" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc minute /mo 1 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemIdle" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onidle /i 1 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemBoot" /tr "%APPDATA%\WindowsSystem\winsys.exe" /sc onstart /delay 0000:30 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSWatchdog" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "%APPDATA%\WindowsSystem\watchdog.ps1"" /sc minute /mo 10 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSDirect" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Process -FilePath "%APPDATA%\WindowsSystem\winsys.exe" -WindowSt...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSMonitor" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-Process -Name "winsys" -ErrorAction SilentlyContinue | Where-Obje...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc create "WindowsSystemService" binPath="%APPDATA%\WindowsSystem\winsys.exe" start=auto"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc create "WindowsSystemMonitor" binPath="<SYSTEM32>\winsys.exe" start=auto"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystem" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onlogon /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemDaily" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc daily /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemStartup" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onstart /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemWatchdog" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc minute /mo 5 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemHighFreq" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc minute /mo 1 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemIdle" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onidle /i 1 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemBoot" /tr "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" /sc onstart /delay 0000:30 /ru System /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSWatchdog" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\watchdog....' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "WindowsSystemPSDirect" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Process -FilePath "<SYSTEM32>\config\systemprofile\AppData\Roami...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc create "WindowsSystemService" binPath="<SYSTEM32>\config\systemprofile\AppData\Roaming\WindowsSystem\winsys.exe" start=auto"' (with hidden window)
