Trojan.Kryptik.NFRE

Trojan.Kryptik.NFRE is a Trojan horse threat that targets computers running Windows. Like other members of the Kryptik family, it is designed to infiltrate a system quietly, without the user's knowledge or consent, and then carry out malicious actions in the background. Security researchers classify this threat with a high danger rating, reflecting the significant harm it can cause once it takes hold of an infected machine.

What Trojan.Kryptik.NFRE Does

Once active on a system, Trojan.Kryptik.NFRE behaves in a manner typical of sophisticated Trojan infections. It is built to gain a foothold on the compromised computer and establish control over key system functions. Threats in this category commonly attempt to download and install additional malicious components, modify system settings without authorization, interfere with security tools, and open a channel that allows remote attackers to issue commands to the infected machine. Depending on the variant and the attacker's goals, this can include harvesting stored credentials, logging keystrokes, capturing screenshots, or monitoring a user's online activity. Because the malware is engineered to operate covertly, it often runs silently in the background, making detection difficult for an untrained eye.

How It Usually Gets Onto Computers

Trojans like this one typically spread through deceptive methods rather than exploiting a single specific vulnerability. Common infection paths include email attachments disguised as invoices, receipts, resumes, or other seemingly legitimate documents, as well as executable files bundled with pirated software, cracked programs, or key generators. Malicious advertisements, compromised websites, and fake software update prompts can also deliver this kind of payload. Because the file extensions involved can vary widely—ranging from executables to seemingly harmless documents or images—users are often tricked into opening the file without suspecting anything is wrong.

Risks for the User

An active infection of this type can expose a user to serious consequences. Given the broad capabilities typically associated with Kryptik-family Trojans, victims may face stolen passwords and financial information, unauthorized remote access to their computer, installation of further malware, corrupted or deleted files, and a general loss of control over system settings. Because the Trojan can operate as a backdoor, it may also serve as an entry point for additional attacks, including ransomware or spyware, compounding the damage over time.

Signs of Infection

Trojans are designed to remain hidden, but certain symptoms can indicate a compromise. Users should watch for unexpected slowdowns in system performance, unfamiliar processes running in Task Manager, programs launching or closing on their own, changes to browser or security settings that were not made by the user, unusual network activity even when idle, and security software being disabled or unable to update. Frequent crashes or unexplained pop-ups can also be warning signs.

How to Stay Protected

Preventing infection starts with cautious online habits. Users should avoid opening email attachments or clicking links from unknown or unexpected senders, refrain from downloading software from unofficial or pirated sources, and keep their operating system and installed applications updated with the latest security patches. Running a reputable, up-to-date anti-malware solution and performing regular system scans can help detect and remove threats like Trojan.Kryptik.NFRE before they cause serious harm. Maintaining regular backups of important files also reduces the impact of any potential compromise, ensuring that data can be recovered even if a system is affected.

Analysis Report

General information

Family Name:	Trojan.Kryptik.NFRE
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: f7329b5b0fc724f92c8e5d32354693dc SHA1: c88c8c84a70f51a3a23c1ee80afce3f7f1259c69 SHA256: 0448EF245659C937AE9226E46487713D7BD2CFBD0D7E0F24017C6C90289D3E46 File Size: 6.79 MB, 6787839 bytes

MD5: be2fac9ea175929596dfc5fd4d96f2e0 SHA1: 401c57ce42f94f197f875040492badb0f316696f SHA256: 188BCE62EAE6B5FB9FC3E28F8734EB1F0E1C71B2CD3126358897073204D8EDE5 File Size: 622.25 KB, 622250 bytes

MD5: 8b16415d153c16c6d86d8da88785d790 SHA1: 957e0ed4aeac7b7d3558734db21e2aab0f126ae1 SHA256: 715B07757808181B3B2046FE4C2F373049688EE41342C701AA99577241B252E5 File Size: 6.79 MB, 6787183 bytes

MD5: ec3faa430a00a0d5b48bd9c3847ffadc SHA1: 5feb0407415743ae8caeddb81f7c596c649ff5f0 SHA256: 698BC0CEA28BC9EDAE60273A7ABCE0C5EF3DCA86087A71B95FC82949F4698A94 File Size: 131.00 KB, 131000 bytes

MD5: 64b250c5436c5e6792c89e38d5b30192 SHA1: 84f97b0e946678b77a9b77cbc4ad601ea3828759 SHA256: A83232C48043EC9954AC4349DDB6B89F926335545BA708E5E48095B9FA2AF085 File Size: 6.79 MB, 6790385 bytes

Show More

MD5: 8506089a507d926af7804fc18ba867a6 SHA1: 0986800bd023b2b4b57b307f6712d3c76c70ac46 SHA256: 70071C35DCB2B8F95145C1F252965BC7AA3A49119D0F6D9F35B13C78EF2B9AA4 File Size: 6.13 MB, 6134943 bytes

MD5: 7fc446210b147c71bccea7c81889b81b SHA1: 5964a1d153abf58853f87d4d3a545465f9d44a4d SHA256: 316BFF44736CA0A8020A3A31028559544D19EAB47C9ABE8C0D6D569AAE30CE02 File Size: 6.79 MB, 6787839 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have security information
• File has TLS information
• File is 64-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

File Traits

• 2+ executable sections
• big overlay
• HighEntropy
• No Version Info
• upx
• x64

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	70
Potentially Malicious Blocks:	7
Whitelisted Blocks:	61
Unknown Blocks:	2

Visual Map

0 0 0 0 0 0 0 ? x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ?

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Kryptik.KPG
• Kryptik.NFRE

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\microsoft\windows\update	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.json	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\microsoft\windows\update\config.json	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe	Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs	Generic Write,Read Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey

Show More

HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe		RegNtPreCreateKey

1926 additional registry modifications are not displayed above.

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtCancelWaitCompletionPacket ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile Show More ntdll.dll!NtCreateKey ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDeleteValueKey ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFlushBuffersFile ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationObject ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Network Winsock2	WSAGetOverlappedResult WSARecvFrom WSASendTo WSASocket WSAStartup WSAttemptAutodialName
User Data Access	GetComputerName GetComputerNameEx GetUserObjectInformation
Encryption Used	BCryptOpenAlgorithmProvider
Network Winsock	bind closesocket freeaddrinfo getaddrinfo getsockname setsockopt socket
Network Info Queried	GetAdaptersAddresses
Network Winhttp	WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest
Anti Debug	IsDebuggerPresent
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 (NULL)

C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot

"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"

Show More

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot

"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot

C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 (NULL)

C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"

"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"

"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 (NULL)

C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"

"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"

"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 (NULL)

C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe "C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"