de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

Analysis

max time kernel
76s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Size

234KB
MD5

6bf90e93ec137ce7ee3ff9395829d827
SHA1

ea83a30e92be04e1e614e95ed62e74f5d1ac1666
SHA256

de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05
SHA512

a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951
SSDEEP

3072:k9wShh9nsKHcQZYxIs1T+Z3edjHDN4HZ4s8ENObhb5npLdnUInuy+iMS3h0qmy:kThh9sKHRFnWs8ENOblJUIurS3h0qj

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	svchost.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	svchost.exe

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 12 IoCs

pid	Process
4772	lsass.exe
3472	smss.exe
1464	svchost.exe
4268	lsass.exe
3420	smss.exe
4432	svchost.exe
176	lsass.exe
308	smss.exe
2268	svchost.exe
4544	lsass.exe
3928	smss.exe
2548	svchost.exe

Sets file execution options in registry 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	lsass.exe

Windows security modification 2 TTPs 16 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	smss.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	lsass.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\I:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\T:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\X:	lsass.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\T:	lsass.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\K:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\U:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\H:	lsass.exe
File opened (read-only)	\??\M:	lsass.exe
File opened (read-only)	\??\W:	lsass.exe
File opened (read-only)	\??\E:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\P:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\F:	lsass.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\B:	lsass.exe
File opened (read-only)	\??\P:	lsass.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\F:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\J:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\N:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\V:	lsass.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\L:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\W:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\J:	lsass.exe
File opened (read-only)	\??\Y:	lsass.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\X:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\R:	lsass.exe
File opened (read-only)	\??\S:	lsass.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\S:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\L:	lsass.exe
File opened (read-only)	\??\B:	smss.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\V:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\Y:	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened (read-only)	\??\G:	lsass.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\N:	lsass.exe
File opened (read-only)	\??\O:	lsass.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\Q:	lsass.exe
File opened (read-only)	\??\W:	smss.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	svchost.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\copy.pif	smss.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	lsass.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	svchost.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	lsass.exe
File opened for modification	C:\Windows\SysWOW64\Oeminfo.ini	lsass.exe
File created	C:\Windows\SysWOW64\_default.pif	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	smss.exe
File created	C:\Windows\SysWOW64\Oeminfo.ini	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	lsass.exe
File created	C:\Windows\SysWOW64\surif.bin	svchost.exe
File created	C:\Windows\SysWOW64\copy.pif	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\SysWOW64\_default.pif	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Oeminfo.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\Oeminfo.ini	svchost.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\SysWOW64\surif.bin	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	smss.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	svchost.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	svchost.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\csrss.exe	lsass.exe
File opened for modification	C:\Windows\.exe	smss.exe
File opened for modification	C:\Windows\win32.exe	smss.exe
File created	C:\Windows\system\lsass.exe	svchost.exe
File opened for modification	C:\Windows\system\winlogon.exe	svchost.exe
File created	C:\Windows\win32.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\system\csrss.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\system\csrss.exe	lsass.exe
File created	C:\Windows\system\winlogon.exe	svchost.exe
File created	C:\Windows\system\winlogon.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\system\svchost.exe	lsass.exe
File created	C:\Windows\win32.exe	smss.exe
File opened for modification	C:\Windows\ActiveX.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\system\csrss.exe	svchost.exe
File opened for modification	C:\Windows\system\svchost.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\.exe	svchost.exe
File opened for modification	C:\Windows\system\smss.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\system\lsass.exe	smss.exe
File opened for modification	C:\Windows\system\svchost.exe	smss.exe
File opened for modification	C:\Windows\system\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\system\winlogon.exe	smss.exe
File created	C:\Windows\system\smss.exe	svchost.exe
File created	C:\Windows\system\svchost.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\system\winlogon.exe	smss.exe
File opened for modification	C:\Windows\win32.exe	lsass.exe
File opened for modification	C:\Windows\system\csrss.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\ActiveX.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\system\smss.exe	lsass.exe
File created	C:\Windows\system\smss.exe	smss.exe
File opened for modification	C:\Windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\winlogon.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\system\lsass.exe	smss.exe
File created	C:\Windows\system\csrss.exe	svchost.exe
File created	C:\Windows\system\csrss.exe	smss.exe
File opened for modification	C:\Windows\ActiveX.exe	smss.exe
File opened for modification	C:\Windows\system\csrss.exe	smss.exe
File created	C:\Windows\system\svchost.exe	svchost.exe
File created	C:\Windows\.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\system\svchost.exe	lsass.exe
File opened for modification	C:\Windows\ActiveX.exe	svchost.exe
File created	C:\Windows\system\smss.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File created	C:\Windows\system\lsass.exe	lsass.exe
File created	C:\Windows\system\smss.exe	lsass.exe
File opened for modification	C:\Windows\system\lsass.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\system\lsass.exe	lsass.exe
File opened for modification	C:\Windows\system\smss.exe	smss.exe
File opened for modification	C:\Windows\ActiveX.exe	lsass.exe
File opened for modification	C:\Windows\win32.exe	svchost.exe
File opened for modification	C:\Windows\system\smss.exe	svchost.exe
File opened for modification	C:\Windows\win32.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\.exe	lsass.exe
File created	C:\Windows\system\winlogon.exe	lsass.exe
File created	C:\Windows\system\svchost.exe	smss.exe
File opened for modification	C:\Windows\.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
File opened for modification	C:\Windows\system\lsass.exe	svchost.exe
File created	C:\Windows\system\lsass.exe	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4772	lsass.exe
1464	svchost.exe
3472	smss.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
4772	lsass.exe
3472	smss.exe
1464	svchost.exe
4268	lsass.exe
3420	smss.exe
4432	svchost.exe
176	lsass.exe
308	smss.exe
2268	svchost.exe
4544	lsass.exe
3928	smss.exe
2548	svchost.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4772	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	81
PID 4736 wrote to memory of 4772	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	81
PID 4736 wrote to memory of 4772	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	81
PID 4736 wrote to memory of 3472	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	82
PID 4736 wrote to memory of 3472	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	82
PID 4736 wrote to memory of 3472	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	82
PID 4736 wrote to memory of 1464	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	83
PID 4736 wrote to memory of 1464	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	83
PID 4736 wrote to memory of 1464	4736	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe	83
PID 3472 wrote to memory of 4268	3472	smss.exe	84
PID 3472 wrote to memory of 4268	3472	smss.exe	84
PID 3472 wrote to memory of 4268	3472	smss.exe	84
PID 3472 wrote to memory of 3420	3472	smss.exe	85
PID 3472 wrote to memory of 3420	3472	smss.exe	85
PID 3472 wrote to memory of 3420	3472	smss.exe	85
PID 3472 wrote to memory of 4432	3472	smss.exe	86
PID 3472 wrote to memory of 4432	3472	smss.exe	86
PID 3472 wrote to memory of 4432	3472	smss.exe	86
PID 4772 wrote to memory of 176	4772	lsass.exe	87
PID 4772 wrote to memory of 176	4772	lsass.exe	87
PID 4772 wrote to memory of 176	4772	lsass.exe	87
PID 4772 wrote to memory of 308	4772	lsass.exe	88
PID 4772 wrote to memory of 308	4772	lsass.exe	88
PID 4772 wrote to memory of 308	4772	lsass.exe	88
PID 4772 wrote to memory of 2268	4772	lsass.exe	89
PID 4772 wrote to memory of 2268	4772	lsass.exe	89
PID 4772 wrote to memory of 2268	4772	lsass.exe	89
PID 1464 wrote to memory of 4544	1464	svchost.exe	90
PID 1464 wrote to memory of 4544	1464	svchost.exe	90
PID 1464 wrote to memory of 4544	1464	svchost.exe	90
PID 1464 wrote to memory of 3928	1464	svchost.exe	91
PID 1464 wrote to memory of 3928	1464	svchost.exe	91
PID 1464 wrote to memory of 3928	1464	svchost.exe	91
PID 1464 wrote to memory of 2548	1464	svchost.exe	92
PID 1464 wrote to memory of 2548	1464	svchost.exe	92
PID 1464 wrote to memory of 2548	1464	svchost.exe	92

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsass.exe

C:\Users\Admin\AppData\Local\Temp\de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe
"C:\Users\Admin\AppData\Local\Temp\de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4736
- C:\Windows\system\lsass.exe
  C:\Windows\system\lsass.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4772
- - C:\Windows\system\lsass.exe
    C:\Windows\system\lsass.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:176
- - C:\Windows\system\smss.exe
    C:\Windows\system\smss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:308
- - C:\Windows\system\svchost.exe
    C:\Windows\system\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
- C:\Windows\system\smss.exe
  C:\Windows\system\smss.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3472
- - C:\Windows\system\lsass.exe
    C:\Windows\system\lsass.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4268
- - C:\Windows\system\smss.exe
    C:\Windows\system\smss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3420
- - C:\Windows\system\svchost.exe
    C:\Windows\system\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4432
- C:\Windows\system\svchost.exe
  C:\Windows\system\svchost.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1464
- - C:\Windows\system\lsass.exe
    C:\Windows\system\lsass.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4544
- - C:\Windows\system\smss.exe
    C:\Windows\system\smss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3928
- - C:\Windows\system\svchost.exe
    C:\Windows\system\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\.exe

Filesize
234KB

MD5
255d99cb5cbd913aefeb6e23df90caf9

SHA1
67a48b659235ee35d52eacf2d893f39fc32023f6

SHA256
82c9f6d360a709f843b13e831b9f73934a73e77d14699df6e2feba8e35f5c063

SHA512
3ca726efacbca6e8d0153bccc3f010f5417aa112a063234452d44f82d180532d96215d00d9d1b6d9a51e2b07ca28ac3cabe3666683264f58c22be69b519b4375

Download Submit
C:\Windows\.exe

Filesize
234KB

MD5
f27532f135edafee488fb7edb9c20383

SHA1
696353097db9229d283845f38ff8ec9658a419b2

SHA256
53b81c5096ec7c8712dd9d9ac578b26390cbc5f139752d67c46d40160330d2f3

SHA512
f63f152ed2912963f9828bcc91154cd604377f547830a9ac341aa38e5c0faeb4db9828695050f005cc90b07407fb324a7d95be38ab23a592358594c3e1a85ff1

Download Submit
C:\Windows\.exe

Filesize
234KB

MD5
2db7be7f4a51d7bbab5fbec5fc15ec50

SHA1
33caabfa420636ca5b4dbdcb0b91846dd877461a

SHA256
fe7d42c787c3dd4557500d9bd23f6b1e1c1d7fe273188ac40a296f5859b78327

SHA512
066d269f44d85ab0f668685a228724e55f6f25edab0261a9f014cb23d41d7b8894e11d9e9ca8fe4f73e7c9f5c56ec395c9b91eea0c3e06fc986586ab93ec0f8a

Download Submit
C:\Windows\ActiveX.exe

Filesize
234KB

MD5
fd33be2524e548322c9398a986ba1ac0

SHA1
26768fec5cd72ba9374681cbb111f3b9fba75b6f

SHA256
8a47f088c53cfc619d4ac517690d969e041b55fdb3448e656cc5423430b2fbf9

SHA512
d995ae06b12a0e412861bc9f831a350593b6ee7e1f97b4bfdc78fd53ea43a16a02b7b2e14a538724d9328f3a7c0e4066157eb6d2729534041d3b8533ad01b920

Download Submit
C:\Windows\ActiveX.exe

Filesize
234KB

MD5
e4339549ee90919dfd91111d11d588f3

SHA1
9b80638f0bdf5861ea621d611efe8bc2d279eecf

SHA256
9bd8928d8876a4d86e5d3ba726b7e8c7dccd2bd0a3477b3a8666e7b499648172

SHA512
ea1fc7b5d0e95d7ee0df6d5133d347dc699779713b5c92e23146e6273af6eeb75dcc65d2c2515404a2ab366b055a8976a666c7031cc6ced1030a257f0dbc1f54

Download Submit
C:\Windows\ActiveX.exe

Filesize
234KB

MD5
c77740600394429ab63881292a06071a

SHA1
a81ec7215dba4362403b6ad8cb93e55c3f399129

SHA256
3808911232f662453e663f0f4cec87242810dd99ed79b76303bf92e196747e29

SHA512
1b4751a74219be7c9f8fdb7280f59aab3ff33edf739f9d2921910b2e4441784218a9ad3ddbb7585b5fa29feb5b4ecf9a2bef52bc70bc57bafa11af984d8a8371

Download Submit
C:\Windows\SysWOW64\Oeminfo.ini

Filesize
106B

MD5
67fa4fca4bfa3de3aa2f9a7cf1b1df56

SHA1
beb76e7eace2503011d87c325a54c2a80420f84f

SHA256
cd7dfd7f48a4a8294808196e5870d541603c6cc3a686c8aca2423993f789b62e

SHA512
fe96f45ec32dbb982760421d9fc21c520cd9c8c8aefa994babbea6f3fa09a28f8a811d7385dc31f2abec53b48569d7a5632f08131e66bd3e32745ca0b0a6962d

Download Submit
C:\Windows\SysWOW64\Oeminfo.ini

Filesize
106B

MD5
67fa4fca4bfa3de3aa2f9a7cf1b1df56

SHA1
beb76e7eace2503011d87c325a54c2a80420f84f

SHA256
cd7dfd7f48a4a8294808196e5870d541603c6cc3a686c8aca2423993f789b62e

SHA512
fe96f45ec32dbb982760421d9fc21c520cd9c8c8aefa994babbea6f3fa09a28f8a811d7385dc31f2abec53b48569d7a5632f08131e66bd3e32745ca0b0a6962d

Download Submit
C:\Windows\SysWOW64\Oeminfo.ini

Filesize
106B

MD5
67fa4fca4bfa3de3aa2f9a7cf1b1df56

SHA1
beb76e7eace2503011d87c325a54c2a80420f84f

SHA256
cd7dfd7f48a4a8294808196e5870d541603c6cc3a686c8aca2423993f789b62e

SHA512
fe96f45ec32dbb982760421d9fc21c520cd9c8c8aefa994babbea6f3fa09a28f8a811d7385dc31f2abec53b48569d7a5632f08131e66bd3e32745ca0b0a6962d

Download Submit
C:\Windows\SysWOW64\_default.pif

Filesize
234KB

MD5
a802b382fac58b41a05f0dadc7a3bca7

SHA1
3f726e23aa7b524826bf50c3a18230a5fc4dafdf

SHA256
9810b7da41844872d925fc96cba636f8e52ed271215286c3294550d72b44ee8d

SHA512
3fbd82cf6c046c19d74ba276023da5335196109c513af5359b7320814663b34b481f7b1124172ef0bc8549627311d470abcc8bd9d6e0824f7a290d82a101f81a

Download Submit
C:\Windows\SysWOW64\_default.pif

Filesize
234KB

MD5
967223228962f0cab681b167e06594bd

SHA1
840c4ee2fb36d91bd697a44388142778893c558d

SHA256
c6b3b96a18f3f2786af2ff79ba18e4ad06f2ee10f32af7f5da738177446908b3

SHA512
e5a6f1ba06a2a75afa1568be6f324b8ca2a9b2d888a44e4dbacdb562758f1ebf6bfb471e39fca9e669b83f6e0469b1bc14def5afd7d9f2a74882d63b6d78ca04

Download Submit
C:\Windows\SysWOW64\_default.pif

Filesize
234KB

MD5
1cf063994b784ee22126e433681439ce

SHA1
b813f804484219b9d08b8f1dc5bf2e91030cb8da

SHA256
d58749ed237ac34ec10fef628426f6120a32145e388bbf9c3908602c8e29ff78

SHA512
9a59603980c5961c99b4596ff788c27c79e0b68fbcc408c7664e54824f7e7a92c890f902b3cfc802b49f3e25de79504e155445a9b685d38d3a43203904ad958e

Download Submit
C:\Windows\SysWOW64\copy.pif

Filesize
234KB

MD5
943ce6671caaafeb0cc264e55d156e99

SHA1
bb75f058f934c93e883516307e206dab054b13be

SHA256
af9cac0b7d95ba1ce286cb2e8efec5697499052819414ebd3fc2b582b6fc37c6

SHA512
b5a9e52ee12526f0307ef1917e25599d77ea2331a6f2774c0c3571cc29f5e17389b9da9efa4719da8d781c246befa61980e3c3c70e5083515c1d0f5e24ceaf4a

Download Submit
C:\Windows\SysWOW64\copy.pif

Filesize
234KB

MD5
2e6d145b9c98cdd69999357bdad13cfe

SHA1
8e5ceb153fde1534e069ea571415b8c3b8b70a57

SHA256
9c128bc8bfa1cd3a7ebf0f57e0d3bece9622517a4f7770699799f21e63db4a0f

SHA512
164f7a52074779cf60444e645220d2a34420b521c639f83900bfbe45dfb0983a72b28f45b657e76aef27a879a9d30a27b57de9f655d24bc2435206a370a57543

Download Submit
C:\Windows\SysWOW64\copy.pif

Filesize
234KB

MD5
9e483a742820ddfc758cfffa534428da

SHA1
2a190cee04182c34b01193b2c97c1de333939527

SHA256
29fe74ef51912a26d9e939b19e27e10af2a7076811f84e7df3330e4f593c4a54

SHA512
3fdc27f291d49fa8ce07a5e4d363ac8cbcb01b1e6267f06f719a2fca32fc194a24ffa25c42f51efa7e34b5938798bd3c89cb86408f07adf3967eb38c614d301b

Download Submit
C:\Windows\SysWOW64\surif.bin

Filesize
234KB

MD5
1e160df4b99fca08dca16e8bd7241fb3

SHA1
52406c368179be812233c5d5d074bd184d87b652

SHA256
dcd4c6466ad061332ae16fb866973aaf3aa5b821bacb443ac7283deed31228bc

SHA512
aac0f3dd1da0611494e4e64f794696382de64cdbb7498066bab55b1ab5daa64cee6de755b21160ba760010aa7f2e82cc9b72494ab0450a30a72004dc5f48b738

Download Submit
C:\Windows\SysWOW64\surif.bin

Filesize
234KB

MD5
0de3b473f11ca2330bdc4fa63d99edeb

SHA1
b3f13ab984800546c36a972c3f189cebb4d484f7

SHA256
608b56a5f7753efda23df48f670550d3a6f22620d6f858b31ff1fdb7c5373ba6

SHA512
237eedd8019362314ac1e750cb8f612fda8f6c024949c34de7ea3f95759ea0a25b984a39cbbd58b85dd5815b0e2d8f37f4409a5cb157097bd38fb3899727323d

Download Submit
C:\Windows\SysWOW64\surif.bin

Filesize
234KB

MD5
98ed7954df5e0f96939e16a10651505f

SHA1
08ba3ee090fa7ca7e0f6104c0e6eca3ed303aeab

SHA256
9915cb147a3957f8e591b8980985340caf8ba451eb76020b0a570b62bb8db05e

SHA512
0b7ff9cdd4df7d7d3ff860fc3f4dbd9cac70452bace3a35e558744a51636510e06fac666f81e16365aaff60f1ee0a6ed6ba3e1577aac18b971f4238dd3e53532

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\system\csrss.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\system\lsass.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\system\smss.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\system\svchost.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\system\winlogon.exe

Filesize
234KB

MD5
6bf90e93ec137ce7ee3ff9395829d827

SHA1
ea83a30e92be04e1e614e95ed62e74f5d1ac1666

SHA256
de7255e8a85dd04701a41c13282199ddefb7dd0f04815d3839b9dd9c1720ca05

SHA512
a3905054ffdd7582d2d74470d1a5406715df989f52cb89b7966c94da583d65633ca9b2db6f4b034753c477a5c02da1a57ce3a06ca6c3f982bf6b0ce4c6f94951

Download Submit
C:\Windows\win32.exe

Filesize
234KB

MD5
1e37afa60ae61cb8ce7a75423d37aaca

SHA1
031fff9ae536f1aeb62299070d12ceb34fdc1ec5

SHA256
a4a9c847d981723ad686c8692c7d48ce042563a22d9cbaba04baf342e8d62404

SHA512
24ef0b8f96c6b176889b2c6adb2237f4ad683b07161b7bbfd74a9d652fab961a96a12d0bebb698dc6244fea4af340ab1dc0804dca265521c6ff8ddc611c66279

Download Submit
C:\Windows\win32.exe

Filesize
234KB

MD5
b4294a82ed878b199a92a71d32348a33

SHA1
d551290ecdf276ee9f33e91e437462be4ded1015

SHA256
f580a44cd0a1e95d21525aced9e5bcb62bdec26229f673ea019ac5a4a29ddd68

SHA512
76e0255e538b19995d3540a9bc0f59a7a06857ebe0b669e1223c4ae5f515ace3189b1ede9e50269985ff014d782a14640dd0706fd8183ffa036a1bbd45593e98

Download Submit
C:\Windows\win32.exe

Filesize
234KB

MD5
8ecd036e488630eea908a994b44cdfef

SHA1
6ea3f97156ea52051ff54feaa64ecbd266a2c21a

SHA256
5b91879f7109290f8ee4e1c94aed8525552b6ed125d1b4c4644a11a41f5ff2fc

SHA512
ddcadf0ed791d9a2f0881878c947faf8a739d7b37d9a41d01502e9dd0c0ad8d0f6ef23bcfbd9a0049ac4e8901a4785f54df83f030707291b4ad5f866cb72c673

Download Submit
C:\baca euy.txt

Filesize
4B

MD5
0ae9bcd0c0b0aa5aab99d84beca26ce8

SHA1
95ae2add76d30dc377e774ec0d5abc17a7832865

SHA256
91a4e2f100227487a802ac040b85700f03520b347fbfe4c23b7bf2d97b43d9fa

SHA512
2e5bce2521d799135a10bb14cc127a0f794d8cdd2bcd97ed90a7f2d4279f72abaf45a58daf7635472b3d845db21f13f03708fc40f89b1963c8344a89df2b3bd0

Download Submit
C:\baca euy.txt

Filesize
4B

MD5
0ae9bcd0c0b0aa5aab99d84beca26ce8

SHA1
95ae2add76d30dc377e774ec0d5abc17a7832865

SHA256
91a4e2f100227487a802ac040b85700f03520b347fbfe4c23b7bf2d97b43d9fa

SHA512
2e5bce2521d799135a10bb14cc127a0f794d8cdd2bcd97ed90a7f2d4279f72abaf45a58daf7635472b3d845db21f13f03708fc40f89b1963c8344a89df2b3bd0

Download Submit
C:\baca euy.txt

Filesize
4B

MD5
0ae9bcd0c0b0aa5aab99d84beca26ce8

SHA1
95ae2add76d30dc377e774ec0d5abc17a7832865

SHA256
91a4e2f100227487a802ac040b85700f03520b347fbfe4c23b7bf2d97b43d9fa

SHA512
2e5bce2521d799135a10bb14cc127a0f794d8cdd2bcd97ed90a7f2d4279f72abaf45a58daf7635472b3d845db21f13f03708fc40f89b1963c8344a89df2b3bd0

Download Submit
memory/176-198-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/308-203-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1464-226-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1464-167-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2268-212-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3420-186-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3472-225-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3472-166-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4268-180-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4432-192-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4544-214-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4736-132-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4736-223-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4772-224-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4772-165-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download