Edit tour

Windows Analysis Report
desaremix.exe

Overview

General Information

Sample name:	desaremix.exe
Analysis ID:	1631383
MD5:	798f093399cdacd81114c62c8a88f7ac
SHA1:	d6e0e7925578a202945a2da15176e158fe85b619
SHA256:	03834e6c7a8bac7bb283f0ffca293cda50b4547237cc32c8b6e16501771cb705
Tags:	exegdimbrkillertrojanuser-2huMarisa
Infos:

Detection

KillMBR

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected KillMBR

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to infect the boot sector

Deletes itself after installation

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows registry editor (regedit)

Disables the Windows task manager (taskmgr)

Infects the VBR (Volume Boot Record) of the hard disk

Joe Sandbox ML detected suspicious sample

Protects its processes via BreakOnTermination flag

Tries to detect virtualization through RDTSC time measurements

Writes directly to the primary disk partition (DR0)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

desaremix.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\desaremix.exe" MD5: 798F093399CDACD81114C62C8A88F7AC)

????????????????.exe (PID: 7420 cmdline: "C:\Users\user\AppData\Local\Temp\????????????????.exe" MD5: 798F093399CDACD81114C62C8A88F7AC)

notepad.exe (PID: 7796 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini MD5: E92D3A824A0578A50D2DD81B5060145F)

notepad.exe (PID: 8236 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\desktop.ini MD5: E92D3A824A0578A50D2DD81B5060145F)

notepad.exe (PID: 8276 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\desktop.ini MD5: E92D3A824A0578A50D2DD81B5060145F)

notepad.exe (PID: 8772 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini MD5: E92D3A824A0578A50D2DD81B5060145F)

WINWORD.EXE (PID: 8808 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\DVWHKMNFNN.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

WINWORD.EXE (PID: 8816 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\DVWHKMNFNN.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

notepad.exe (PID: 5724 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini MD5: E92D3A824A0578A50D2DD81B5060145F)

EXCEL.EXE (PID: 8744 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 1284 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" MD5: 4A871771235598812032C822E6F68F19)

WINWORD.EXE (PID: 8372 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\HTAGVDFUIE.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

WINWORD.EXE (PID: 5696 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\HTAGVDFUIE.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

EXCEL.EXE (PID: 932 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\KATAXZVCPS.xlsx" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 940 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\KATAXZVCPS.xlsx" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 6232 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\LTKMYBSEYZ.xlsx" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 6196 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\LTKMYBSEYZ.xlsx" MD5: 4A871771235598812032C822E6F68F19)

hh.exe (PID: 6220 cmdline: "C:\Windows\hh.exe" C:\Program Files\7-Zip\7-zip.chm MD5: 2C8FE78D53C8CA27523A71DFD2938241)

7z.exe (PID: 6376 cmdline: "C:\Program Files\7-Zip\7z.exe" MD5: 9A1DD1D96481D61934DCC2D568971D06)

conhost.exe (PID: 6052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Music.UI.exe (PID: 2908 cmdline: "C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe" -ServerName:Microsoft.ZuneMusic.AppX48dcrcgzqqdshm3kf61t0cm5e9pyd6h6.mca MD5: F963F75C0AD152437E10D656A00793A3)

rundll32.exe (PID: 8700 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: desaremix.exe PID: 7400	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security
Process Memory Space: ????????????????.exe PID: 7420	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.desaremix.exe.310000.0.unpack	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security
0.0.desaremix.exe.310000.0.unpack	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security
1.2.????????????????.exe.6c0000.0.unpack	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security
1.0.????????????????.exe.6c0000.0.unpack	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security

Sigma Signatures

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 52.123.129.14, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 8744, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49760

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49751, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 8808, Protocol: tcp, SourceIp: 52.123.129.14, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T01:52:53.290701+0100	2028371	3	Unknown Traffic	192.168.2.4	49751	52.123.129.14	443	TCP
2025-03-07T01:52:56.405402+0100	2028371	3	Unknown Traffic	192.168.2.4	49762	52.123.129.14	443	TCP
2025-03-07T01:52:58.336410+0100	2028371	3	Unknown Traffic	192.168.2.4	49760	52.123.129.14	443	TCP
2025-03-07T01:53:13.644418+0100	2028371	3	Unknown Traffic	192.168.2.4	49769	52.123.129.14	443	TCP
2025-03-07T01:53:13.646472+0100	2028371	3	Unknown Traffic	192.168.2.4	49770	52.123.129.14	443	TCP
2025-03-07T01:53:22.324183+0100	2028371	3	Unknown Traffic	192.168.2.4	49790	13.107.246.67	443	TCP
2025-03-07T01:53:24.730600+0100	2028371	3	Unknown Traffic	192.168.2.4	49776	52.123.128.14	443	TCP
2025-03-07T01:53:24.737458+0100	2028371	3	Unknown Traffic	192.168.2.4	49774	52.123.128.14	443	TCP
2025-03-07T01:53:42.339226+0100	2028371	3	Unknown Traffic	192.168.2.4	49795	13.107.246.67	443	TCP
2025-03-07T01:53:48.665840+0100	2028371	3	Unknown Traffic	192.168.2.4	49785	52.123.128.14	443	TCP
2025-03-07T01:53:48.726782+0100	2028371	3	Unknown Traffic	192.168.2.4	49784	52.123.128.14	443	TCP
2025-03-07T01:53:55.157462+0100	2028371	3	Unknown Traffic	192.168.2.4	49787	52.123.128.14	443	TCP
2025-03-07T01:53:58.368603+0100	2028371	3	Unknown Traffic	192.168.2.4	49789	52.123.128.14	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: desaremix.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe

Avira: detection malicious, Label: HEUR/AGEN.1318680

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: desaremix.exe	ReversingLabs: Detection: 52%
Source: desaremix.exe	Virustotal: Detection: 63%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.1% probability

Source: desaremix.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: desaremix.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\ASUS\Documents\Malwares\My Creations\desaremix\Release\desaremix.pdb source: desaremix.exe, ????????????????.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_003119C0 lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpW,ShellExecuteW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,ShellExecuteW,Sleep,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_003119C0
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C19C0 lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpW,ShellExecuteW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,ShellExecuteW,Sleep,FindNextFileW,FindClose,RemoveDirectoryW,		1_2_006C19C0

Source: C:\Users\user\Desktop\desaremix.exe

Code function: 0_2_00311C30 LoadLibraryW,GetProcAddress,FreeLibrary,CreateThread,CloseHandle,CloseHandle,CreateFileW,WriteFile,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,Sleep,GetLogicalDriveStringsW,CreateThread,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateThread,CreateThread,CloseHandle,CloseHandle,CreateThread,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,Sleep,

0_2_00311C30

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Joe Sandbox View	IP Address: 95.101.148.7 95.101.148.7
Source: Joe Sandbox View	IP Address: 13.107.246.67 13.107.246.67
Source: Joe Sandbox View	IP Address: 52.123.129.14 52.123.129.14
Source: Joe Sandbox View	IP Address: 52.123.128.14 52.123.128.14

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49795 -> 13.107.246.67:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49787 -> 52.123.128.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49774 -> 52.123.128.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49769 -> 52.123.129.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49762 -> 52.123.129.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49770 -> 52.123.129.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49785 -> 52.123.128.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49790 -> 13.107.246.67:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49751 -> 52.123.129.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49760 -> 52.123.129.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49784 -> 52.123.128.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49776 -> 52.123.128.14:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49789 -> 52.123.128.14:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: settings-ssl.xboxlive.com

Source: hh.exe, 00000024.00000002.3599916331.000002591DAA3000.00000004.00000020.00020000.00000000.sdmp, hh.exe, 00000024.00000002.3599916331.000002591DA13000.00000004.00000020.00020000.00000000.sdmp, hh.exe, 00000024.00000002.3613273408.0000026125889000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.7-zip.org
Source: hh.exe, 00000024.00000002.3599916331.000002591DA13000.00000004.00000020.00020000.00000000.sdmp, hh.exe, 00000024.00000002.3613273408.0000026125889000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.7-zip.org/support.html
Source: hh.exe, 00000024.00000002.3599916331.000002591DAA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.7-zip.org9
Source: Music.UI.exe, 00000009.00000002.3661421891.000001E232400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: Music.UI.exe, 00000009.00000002.3666997035.000001E232CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: Music.UI.exe, 00000009.00000002.3667955482.000001E232D53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSy
Source: Music.UI.exe, 00000009.00000002.3691704578.000001E23301B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: Music.UI.exe, 00000009.00000002.3691704578.000001E23301B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local/
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.netete
Source: Music.UI.exe, 00000009.00000002.3662104598.000001E232540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://musicart.xboxlive.com/9/5c6a4700-0000-0000-0000-000000000002/504/image.jpg
Source: Music.UI.exe, 00000009.00000002.3662104598.000001E232540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://musicart.xboxlive.com/9/e74d4600-0000-0000-0000-000000000002/504/image.jpg
Source: Music.UI.exe, 00000009.00000002.3644171064.000001E23128E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://musicimage.xboxlive.com
Source: Music.UI.exe, 00000009.00000002.3697992513.000001E233227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/
Source: Music.UI.exe, 00000009.00000003.2024621740.000001E232D86000.00000004.00000020.00020000.00000000.sdmp, Music.UI.exe, 00000009.00000002.3660740574.000001E231E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_music/configuration.xml
Source: Music.UI.exe, 00000009.00000002.3660740574.000001E231E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_music/configuration.xml2
Source: Music.UI.exe, 00000009.00000002.3668381739.000001E232D79000.00000004.00000020.00020000.00000000.sdmp, Music.UI.exe, 00000009.00000003.2024621740.000001E232D86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_music/configuration.xmlnal
Source: Music.UI.exe, 00000009.00000002.3631277748.000001E22A4B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_music/configuration.xmlset
Source: Music.UI.exe, 00000009.00000003.2024621740.000001E232D86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_music/configuration.xmltio
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/C:
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: Music.UI.exe, 00000009.00000002.3695893763.000001E23305A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/P
Source: Music.UI.exe, 00000009.00000002.3662104598.000001E23255E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com5png1002

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Spam, unwanted Advertisements and Ransom Demands

Yara detected KillMBR

Source: Yara match	File source: 0.2.desaremix.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.desaremix.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.????????????????.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.????????????????.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: desaremix.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ????????????????.exe PID: 7420, type: MEMORYSTR

Operating System Destruction

Yara detected KillMBR

Source: Yara match	File source: 0.2.desaremix.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.desaremix.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.????????????????.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.????????????????.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: desaremix.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ????????????????.exe PID: 7420, type: MEMORYSTR

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_00311C30 CreateFileW on filename \\.\PhysicalDrive0		0_2_00311C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C1C30 CreateFileW on filename \\.\PhysicalDrive0		1_2_006C1C30

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe

Process information set: 01 00 00 00

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_0031DBD5		0_2_0031DBD5
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006CDBD5		1_2_006CDBD5

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_00311770 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00311770
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C1770 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		1_2_006C1770

Source: C:\Users\user\Desktop\desaremix.exe	Command line argument: user32.dll	0_2_00311C30
Source: C:\Users\user\Desktop\desaremix.exe	Command line argument: ntdll.dll	0_2_00311C30
Source: C:\Users\user\Desktop\desaremix.exe	Command line argument: DisableTaskMgr	0_2_00311C30
Source: C:\Users\user\Desktop\desaremix.exe	Command line argument: DisableCMD	0_2_00311C30
Source: C:\Users\user\Desktop\desaremix.exe	Command line argument: ntdll.dll	0_2_00311C30
Source: C:\Users\user\Desktop\desaremix.exe	Command line argument: ^1	0_2_0031E1B0
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Command line argument: user32.dll	1_2_006C1C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Command line argument: ntdll.dll	1_2_006C1C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Command line argument: DisableTaskMgr	1_2_006C1C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Command line argument: DisableCMD	1_2_006C1C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Command line argument: ntdll.dll	1_2_006C1C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Command line argument: ^l	1_2_006CE1B0

Source: unknown	Process created: C:\Users\user\Desktop\desaremix.exe "C:\Users\user\Desktop\desaremix.exe"
Source: C:\Users\user\Desktop\desaremix.exe	Process created: C:\Users\user\AppData\Local\Temp\????????????????.exe "C:\Users\user\AppData\Local\Temp\????????????????.exe"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini
Source: unknown	Process created: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe "C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe" -ServerName:Microsoft.ZuneMusic.AppX48dcrcgzqqdshm3kf61t0cm5e9pyd6h6.mca
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\desktop.ini
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\DVWHKMNFNN.docx" /o ""
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\DVWHKMNFNN.docx" /o ""
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\HTAGVDFUIE.docx" /o ""
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\HTAGVDFUIE.docx" /o ""
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\KATAXZVCPS.xlsx"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\KATAXZVCPS.xlsx"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\LTKMYBSEYZ.xlsx"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\LTKMYBSEYZ.xlsx"
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\hh.exe "C:\Windows\hh.exe" C:\Program Files\7-Zip\7-zip.chm
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe"
Source: C:\Program Files\7-Zip\7z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\desaremix.exe	Process created: C:\Users\user\AppData\Local\Temp\????????????????.exe "C:\Users\user\AppData\Local\Temp\????????????????.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\DVWHKMNFNN.docx" /o ""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\DVWHKMNFNN.docx" /o ""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\HTAGVDFUIE.docx" /o ""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\HTAGVDFUIE.docx" /o ""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\KATAXZVCPS.xlsx"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\KATAXZVCPS.xlsx"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\LTKMYBSEYZ.xlsx"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\LTKMYBSEYZ.xlsx"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Windows\hh.exe "C:\Windows\hh.exe" C:\Program Files\7-Zip\7-zip.chm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Automated click: OK
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Automated click: OK
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Automated click: OK
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Automated click: OK

Source: desaremix.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: desaremix.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: desaremix.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: desaremix.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: desaremix.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: desaremix.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: desaremix.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: desaremix.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: desaremix.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: desaremix.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: desaremix.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: desaremix.exe	Static PE information: section name: _RDATA
Source: ????????????????.exe.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_00314C06 push ecx; ret		0_2_00314C19
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C4C06 push ecx; ret		1_2_006C4C19

Source: C:\Users\user\Desktop\desaremix.exe	Code function: LoadLibraryW,GetProcAddress,FreeLibrary,CreateThread,CloseHandle,CloseHandle,CreateFileW,WriteFile,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,Sleep,GetLogicalDriveStringsW,CreateThread,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateThread,CreateThread,CloseHandle,CloseHandle,CreateThread,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,Sleep, \\.\PhysicalDrive0		0_2_00311C30
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: LoadLibraryW,GetProcAddress,FreeLibrary,CreateThread,CloseHandle,CloseHandle,CreateFileW,WriteFile,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,RtlSetProcessIsCritical,FreeLibrary,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,Sleep,GetLogicalDriveStringsW,CreateThread,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateThread,CreateThread,CloseHandle,CloseHandle,CreateThread,CloseHandle,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,Sleep, \\.\PhysicalDrive0		1_2_006C1C30

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\hh.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\hh.exe	Memory allocated: 26125830000 memory reserve \| memory write watch
Source: C:\Windows\hh.exe	Memory allocated: 26125B00000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe TID: 7544	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe TID: 7548	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe TID: 7548	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 7400	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_00316E5D mov eax, dword ptr fs:[00000030h]		0_2_00316E5D
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C6E5D mov eax, dword ptr fs:[00000030h]		1_2_006C6E5D

Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_003144A6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003144A6
Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_00314978 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00314978
Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_00314B0B SetUnhandledExceptionFilter,	0_2_00314B0B
Source: C:\Users\user\Desktop\desaremix.exe	Code function: 0_2_003177F8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003177F8
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C44A6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_006C44A6
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C4978 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_006C4978
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C4B0B SetUnhandledExceptionFilter,	1_2_006C4B0B
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Code function: 1_2_006C77F8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_006C77F8

Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\????????????????.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00001.jrs VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00002.jrs VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.jfm VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\tmp.edb VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\SRPData.xml VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\DiagOutputDir VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\DiagOutputDir\CriticalError_playbackTrace_1741308664.txt VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\DiagOutputDir\CriticalError_playbackTrace_1741308720.txt VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\DiagOutputDir\CriticalError_playbackTrace_1741308731.txt VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformation
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	4 Bootkit	1 Access Token Manipulation	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	4 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	14 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Bootkit	DCSync	133 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report desaremix.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
desaremix.exe