64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

Analysis

max time kernel
20s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Size

234KB
MD5

69449d731033652095164c586762b548
SHA1

143e824c2032d2e51ed0b3412e6b8e5239c7e87f
SHA256

64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627
SHA512

cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547
SSDEEP

3072:k9wShh9nsKHcQZYxIs1T+Z3edjHDN4HZ4s8ENObhb5npLdnUInuy+iMS3h0qmeE:kThh9sKHRFnWs8ENOblJUIurS3h0qe

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\copy.pif"	svchost.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	svchost.exe

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 12 IoCs

pid	Process
4780	lsass.exe
5036	smss.exe
2132	svchost.exe
556	lsass.exe
2092	smss.exe
1792	svchost.exe
112	lsass.exe
4752	lsass.exe
1260	smss.exe
3872	smss.exe
2736	svchost.exe
2664	svchost.exe

Sets file execution options in registry 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\win32.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\win32.exe"	smss.exe

Windows security modification 2 TTPs 16 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	smss.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ present = "C:\\Windows\\.exe"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Default = "C:\\Windows\\system32\\_default.pif"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Windows\\system\\winlogon.exe"	smss.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	lsass.exe
File opened (read-only)	\??\U:	lsass.exe
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\F:	lsass.exe
File opened (read-only)	\??\L:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\Q:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\W:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\W:	lsass.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\E:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\X:	lsass.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\W:	smss.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\I:	lsass.exe
File opened (read-only)	\??\F:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\M:	lsass.exe
File opened (read-only)	\??\L:	lsass.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\X:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\Q:	lsass.exe
File opened (read-only)	\??\S:	lsass.exe
File opened (read-only)	\??\T:	lsass.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\F:	svchost.exe
File opened (read-only)	\??\K:	lsass.exe
File opened (read-only)	\??\S:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\T:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\E:	lsass.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\J:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\G:	lsass.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\K:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\Z:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\I:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\R:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\F:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\O:	lsass.exe
File opened (read-only)	\??\Z:	lsass.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\G:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\M:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\O:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened (read-only)	\??\P:	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	smss.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copy.pif	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	lsass.exe
File opened for modification	C:\Windows\SysWOW64\Oeminfo.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\SysWOW64\Oeminfo.ini	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	svchost.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	svchost.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	smss.exe
File opened for modification	C:\Windows\SysWOW64\Oeminfo.ini	svchost.exe
File created	C:\Windows\SysWOW64\_default.pif	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	lsass.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	smss.exe
File created	C:\Windows\SysWOW64\surif.bin	smss.exe
File created	C:\Windows\SysWOW64\surif.bin	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\SysWOW64\surif.bin	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\SysWOW64\_default.pif	lsass.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	svchost.exe
File created	C:\Windows\SysWOW64\copy.pif	smss.exe
File opened for modification	C:\Windows\SysWOW64\copy.pif	smss.exe
File opened for modification	C:\Windows\SysWOW64\Oeminfo.ini	lsass.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\lsass.exe	lsass.exe
File created	C:\Windows\system\svchost.exe	smss.exe
File opened for modification	C:\Windows\system\lsass.exe	svchost.exe
File opened for modification	C:\Windows\system\smss.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\system\csrss.exe	lsass.exe
File opened for modification	C:\Windows\system\winlogon.exe	smss.exe
File opened for modification	C:\Windows\win32.exe	svchost.exe
File opened for modification	C:\Windows\win32.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\ActiveX.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\system\lsass.exe	smss.exe
File opened for modification	C:\Windows\win32.exe	smss.exe
File opened for modification	C:\Windows\system\smss.exe	svchost.exe
File opened for modification	C:\Windows\system\svchost.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\.exe	smss.exe
File opened for modification	C:\Windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\smss.exe	smss.exe
File created	C:\Windows\system\csrss.exe	svchost.exe
File opened for modification	C:\Windows\system\csrss.exe	svchost.exe
File opened for modification	C:\Windows\system\csrss.exe	lsass.exe
File created	C:\Windows\system\winlogon.exe	smss.exe
File opened for modification	C:\Windows\system\lsass.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\system\smss.exe	svchost.exe
File created	C:\Windows\system\smss.exe	lsass.exe
File created	C:\Windows\system\svchost.exe	lsass.exe
File opened for modification	C:\Windows\system\svchost.exe	smss.exe
File created	C:\Windows\.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\system\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\ActiveX.exe	lsass.exe
File opened for modification	C:\Windows\system\csrss.exe	smss.exe
File created	C:\Windows\ActiveX.exe	smss.exe
File opened for modification	C:\Windows\ActiveX.exe	smss.exe
File created	C:\Windows\system\lsass.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\system\svchost.exe	lsass.exe
File opened for modification	C:\Windows\win32.exe	lsass.exe
File created	C:\Windows\system\lsass.exe	smss.exe
File opened for modification	C:\Windows\.exe	svchost.exe
File created	C:\Windows\win32.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\system\winlogon.exe	lsass.exe
File created	C:\Windows\system\smss.exe	smss.exe
File opened for modification	C:\Windows\system\winlogon.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\.exe	lsass.exe
File created	C:\Windows\system\lsass.exe	lsass.exe
File created	C:\Windows\win32.exe	svchost.exe
File created	C:\Windows\system\svchost.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\ActiveX.exe	svchost.exe
File created	C:\Windows\system\winlogon.exe	svchost.exe
File opened for modification	C:\Windows\system\winlogon.exe	svchost.exe
File created	C:\Windows\system\smss.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\system\csrss.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\system\svchost.exe	svchost.exe
File created	C:\Windows\system\winlogon.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\ActiveX.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File created	C:\Windows\system\lsass.exe	svchost.exe
File opened for modification	C:\Windows\system\csrss.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
File opened for modification	C:\Windows\system\smss.exe	lsass.exe
File created	C:\Windows\system\csrss.exe	smss.exe
File opened for modification	C:\Windows\.exe	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
4780	lsass.exe
5036	smss.exe
2132	svchost.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
4780	lsass.exe
5036	smss.exe
2132	svchost.exe
556	lsass.exe
2092	smss.exe
1792	svchost.exe
112	lsass.exe
4752	lsass.exe
1260	smss.exe
3872	smss.exe
2736	svchost.exe
2664	svchost.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4780	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	83
PID 5080 wrote to memory of 4780	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	83
PID 5080 wrote to memory of 4780	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	83
PID 5080 wrote to memory of 5036	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	84
PID 5080 wrote to memory of 5036	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	84
PID 5080 wrote to memory of 5036	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	84
PID 5080 wrote to memory of 2132	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	85
PID 5080 wrote to memory of 2132	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	85
PID 5080 wrote to memory of 2132	5080	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe	85
PID 4780 wrote to memory of 556	4780	lsass.exe	86
PID 4780 wrote to memory of 556	4780	lsass.exe	86
PID 4780 wrote to memory of 556	4780	lsass.exe	86
PID 4780 wrote to memory of 2092	4780	lsass.exe	87
PID 4780 wrote to memory of 2092	4780	lsass.exe	87
PID 4780 wrote to memory of 2092	4780	lsass.exe	87
PID 4780 wrote to memory of 1792	4780	lsass.exe	88
PID 4780 wrote to memory of 1792	4780	lsass.exe	88
PID 4780 wrote to memory of 1792	4780	lsass.exe	88
PID 2132 wrote to memory of 112	2132	svchost.exe	89
PID 2132 wrote to memory of 112	2132	svchost.exe	89
PID 2132 wrote to memory of 112	2132	svchost.exe	89
PID 5036 wrote to memory of 4752	5036	smss.exe	90
PID 5036 wrote to memory of 4752	5036	smss.exe	90
PID 5036 wrote to memory of 4752	5036	smss.exe	90
PID 2132 wrote to memory of 1260	2132	svchost.exe	91
PID 2132 wrote to memory of 1260	2132	svchost.exe	91
PID 2132 wrote to memory of 1260	2132	svchost.exe	91
PID 5036 wrote to memory of 3872	5036	smss.exe	92
PID 5036 wrote to memory of 3872	5036	smss.exe	92
PID 5036 wrote to memory of 3872	5036	smss.exe	92
PID 2132 wrote to memory of 2736	2132	svchost.exe	93
PID 2132 wrote to memory of 2736	2132	svchost.exe	93
PID 2132 wrote to memory of 2736	2132	svchost.exe	93
PID 5036 wrote to memory of 2664	5036	smss.exe	94
PID 5036 wrote to memory of 2664	5036	smss.exe	94
PID 5036 wrote to memory of 2664	5036	smss.exe	94

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe

C:\Users\Admin\AppData\Local\Temp\64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe
"C:\Users\Admin\AppData\Local\Temp\64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5080
- C:\Windows\system\lsass.exe
  C:\Windows\system\lsass.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4780
- - C:\Windows\system\lsass.exe
    C:\Windows\system\lsass.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
- - C:\Windows\system\smss.exe
    C:\Windows\system\smss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2092
- - C:\Windows\system\svchost.exe
    C:\Windows\system\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
- C:\Windows\system\smss.exe
  C:\Windows\system\smss.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5036
- - C:\Windows\system\lsass.exe
    C:\Windows\system\lsass.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4752
- - C:\Windows\system\smss.exe
    C:\Windows\system\smss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3872
- - C:\Windows\system\svchost.exe
    C:\Windows\system\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2664
- C:\Windows\system\svchost.exe
  C:\Windows\system\svchost.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2132
- - C:\Windows\system\lsass.exe
    C:\Windows\system\lsass.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:112
- - C:\Windows\system\smss.exe
    C:\Windows\system\smss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
- - C:\Windows\system\svchost.exe
    C:\Windows\system\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\.exe

Filesize
234KB

MD5
ed99909915c1add72925c1071cf9162c

SHA1
c930e739b406b5420b458920ee455a8b7687d45c

SHA256
c4c3386852b42e609f30e7f56393bc0358daf586805d8809b67b1ca1b4a91a5f

SHA512
6d611cf9a2df4a153b0971324d63a6bdc013a297106601a9a0113995c1c2dda54957198b0a1a79202c7d5fcfda9cbc1f9d22a70154a56e01a8bf3be1a0c8323f

Download Submit
C:\Windows\.exe

Filesize
234KB

MD5
94dce36930b426221c1dd1b382a4447e

SHA1
8ca8b72952135af9bb21a4d082747e9565f04627

SHA256
281897e01a508d7729ee833d7d5f80c1f5a546bd74f5e75a75be907329ace401

SHA512
bfcbc82fcc4b6b92b4805cdebb583ea85eec453ceb6a5fda19bda38f297390df356ae81372ec16e8cf45c0544f85d5d9a259f483c763ac8147ec59cd0ac0040f

Download Submit
C:\Windows\.exe

Filesize
234KB

MD5
1bd3a77934134f76abfd7c75605027de

SHA1
08c5969ec16eb0736fc156087b341683f875a0ea

SHA256
c8c360be42511f35f981b018f8752415d274b6a1abcd8dc1410ab1951015d229

SHA512
6403891669f135eb87ef337d481a4ee24d7f75eeec7b17972cea6b28c5a1a932a57ebbbecd6c59afe059eeb730bc787da38531e201a2cdbb7cde89495c9866c7

Download Submit
C:\Windows\ActiveX.exe

Filesize
234KB

MD5
4bac613f7a7192cd7cf5b88a8046118a

SHA1
6c57d43d4b585e0675345afc0b4ebf8208908359

SHA256
48ea50216b01c8cab6f712b38b2f38901c1ce516c3a867d84cd51a63c749318c

SHA512
8cfc3c910585cf461b51a050baece79ea51caa381d3b8f5c3bf1df0893a4520dff92adaa853e978082afa664535f6f78789ffc2d30ccc9719866a825f5ce3f78

Download Submit
C:\Windows\ActiveX.exe

Filesize
234KB

MD5
72de6a378317c76785de5df348e90a0a

SHA1
7d1626144c9c01ff0266907eb061b27aa25d6873

SHA256
1b9ff8c002ec093f538308a6072b7ea510a8565287c42d020828ffc7ceb1bf51

SHA512
bc6dcec55985fd68944486e1e9bef4eda2925903d82d53b750d6f598927f2442b0501e74d889631490f66f2fbf8ad00f56fc8cea7e8f5fe4e8b46c534de9a823

Download Submit
C:\Windows\ActiveX.exe

Filesize
234KB

MD5
0c37ac37bd68018e266abb34dc0aaa88

SHA1
889708c6082560961da8161bab82d7f703b38cda

SHA256
17e00982b137050c055ff605f8c4eb54d6cadd54f95a8d35ae646b454eeb399a

SHA512
034caf21729d56297e337303446387f09864fcefe584418128c7893e08b9e3fc31f32f9daefd50e159662528f8a0db89edadb724154e515fd8478635d548999f

Download Submit
C:\Windows\SysWOW64\Oeminfo.ini

Filesize
106B

MD5
67fa4fca4bfa3de3aa2f9a7cf1b1df56

SHA1
beb76e7eace2503011d87c325a54c2a80420f84f

SHA256
cd7dfd7f48a4a8294808196e5870d541603c6cc3a686c8aca2423993f789b62e

SHA512
fe96f45ec32dbb982760421d9fc21c520cd9c8c8aefa994babbea6f3fa09a28f8a811d7385dc31f2abec53b48569d7a5632f08131e66bd3e32745ca0b0a6962d

Download Submit
C:\Windows\SysWOW64\Oeminfo.ini

Filesize
106B

MD5
67fa4fca4bfa3de3aa2f9a7cf1b1df56

SHA1
beb76e7eace2503011d87c325a54c2a80420f84f

SHA256
cd7dfd7f48a4a8294808196e5870d541603c6cc3a686c8aca2423993f789b62e

SHA512
fe96f45ec32dbb982760421d9fc21c520cd9c8c8aefa994babbea6f3fa09a28f8a811d7385dc31f2abec53b48569d7a5632f08131e66bd3e32745ca0b0a6962d

Download Submit
C:\Windows\SysWOW64\Oeminfo.ini

Filesize
106B

MD5
67fa4fca4bfa3de3aa2f9a7cf1b1df56

SHA1
beb76e7eace2503011d87c325a54c2a80420f84f

SHA256
cd7dfd7f48a4a8294808196e5870d541603c6cc3a686c8aca2423993f789b62e

SHA512
fe96f45ec32dbb982760421d9fc21c520cd9c8c8aefa994babbea6f3fa09a28f8a811d7385dc31f2abec53b48569d7a5632f08131e66bd3e32745ca0b0a6962d

Download Submit
C:\Windows\SysWOW64\_default.pif

Filesize
234KB

MD5
c5b05eab662795e055bef89d66c244ed

SHA1
5249b7ef0a6e7894b8e69c0c7a6b5ac8c2419015

SHA256
c98f29326aace5d6de5c788cdbfbc386e91f4baa8d00e577245b3b7c30057274

SHA512
1b1ea45e671915cb3431fed8b5225418b60728b067c916c4b06234d80b7aa9538a72fc49759c9c8649e174a1524afee3d116d9820ef0ce1f5a54e52627e69817

Download Submit
C:\Windows\SysWOW64\_default.pif

Filesize
234KB

MD5
5db54f1a84318bce1a6743cc87573c6e

SHA1
8fb823a98efa431fac2760b291f7b0267473a0ee

SHA256
e42bd5200b9a0cafe8daa079b8dea0b9c0a477b55547062fed05feed738079ae

SHA512
f94ff00d1664f8fab25e6b88c4afac7abce347fb5ab9aeb469104382f68c3eff77ba9284cb2734614e285bc8ffd95340a57962fc896ea976d1b08a9f2ab73824

Download Submit
C:\Windows\SysWOW64\_default.pif

Filesize
234KB

MD5
5db54f1a84318bce1a6743cc87573c6e

SHA1
8fb823a98efa431fac2760b291f7b0267473a0ee

SHA256
e42bd5200b9a0cafe8daa079b8dea0b9c0a477b55547062fed05feed738079ae

SHA512
f94ff00d1664f8fab25e6b88c4afac7abce347fb5ab9aeb469104382f68c3eff77ba9284cb2734614e285bc8ffd95340a57962fc896ea976d1b08a9f2ab73824

Download Submit
C:\Windows\SysWOW64\copy.pif

Filesize
234KB

MD5
840edf195206f0ba94470606c7d34fc2

SHA1
70b687f04ddfbb0b6c364f08860a6a59bbc64aad

SHA256
22bd1b0004158b6dff980228c2b687e568a1d827429359f8262ac1ac3d31027a

SHA512
3bc10f01c3fad99857cfec811e03a376cb9c90d7c2148e212cfa3511a880839bd2490011ccc48c97cbd2eaa8edb0564c3386594b67c69e5ecf4be47e8614a2e3

Download Submit
C:\Windows\SysWOW64\copy.pif

Filesize
234KB

MD5
c7cf60f99ef6257bfac26819351acba7

SHA1
04958acfa01f49b59e73ea1132ff5088ae51ae0c

SHA256
3003e18ffdddf7ca8a9a545aa72f8e8c02970d6b73079b6ebe1f65b1d486cf10

SHA512
54ecef9d64678634ced1adc36f2ecb31cb0852452cd60c36d3d2788c2f33419f5ffdba61b8c34fb9f33504529160291a6237426e7a9ef8d8ec39f8ae3f7553a5

Download Submit
C:\Windows\SysWOW64\copy.pif

Filesize
234KB

MD5
c7cf60f99ef6257bfac26819351acba7

SHA1
04958acfa01f49b59e73ea1132ff5088ae51ae0c

SHA256
3003e18ffdddf7ca8a9a545aa72f8e8c02970d6b73079b6ebe1f65b1d486cf10

SHA512
54ecef9d64678634ced1adc36f2ecb31cb0852452cd60c36d3d2788c2f33419f5ffdba61b8c34fb9f33504529160291a6237426e7a9ef8d8ec39f8ae3f7553a5

Download Submit
C:\Windows\SysWOW64\surif.bin

Filesize
234KB

MD5
c594edbc07fd3742708eafa00ae53a93

SHA1
e1bc25d6fbb4cb74694c81a693651faa3be51382

SHA256
bf0e796fe5e4fe19b73070fb3e18632ac34367e7adafd5a87e140e22e9eac751

SHA512
af74b43bac9f818efcdbf046017bf7388b15795a3fc885a6e1ac882b6a0846fb54af0b4d811a86441c7fed04b5d143c7fbe82ee97852b7897ac606905fd9f20a

Download Submit
C:\Windows\SysWOW64\surif.bin

Filesize
234KB

MD5
546bc3f528aa5859bcb7cb9c2f980605

SHA1
38da1d1919d00b24b7944273e090050b0d9b5783

SHA256
4d47491fac60ce04200261a6d1c83ed641fe65c5a28f2b9e2108144b7a82b478

SHA512
1c294645b79fcafe5101a16665d5a476430c10247fc7cc3b3b84f2aa639cc55c45d479d9987567dddc6d851cff53297d940f21bb549fb745df48e59b07d0eb6a

Download Submit
C:\Windows\SysWOW64\surif.bin

Filesize
234KB

MD5
e87008b821a79a0296c7d32ff962eec8

SHA1
176d82772cd26ad8dc0b58b65844e60f30b1cfb4

SHA256
f8ebe7a3a8f9416edf3204d5eba68b23a95828242f3ac44546006db219ae0660

SHA512
f1e19194f7f3d5a2f85d9bfb55fa55ebfc8278cd90e523597d26dd6372127eb6181e6e15c5b32e4cf501634e36b3eef4faddaa515322f745d6f458920a33b9d3

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\lsass.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\smss.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\System\svchost.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\system\csrss.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\system\lsass.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\system\smss.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\system\svchost.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\system\winlogon.exe

Filesize
234KB

MD5
69449d731033652095164c586762b548

SHA1
143e824c2032d2e51ed0b3412e6b8e5239c7e87f

SHA256
64d466a98837693bac1ac7dbc60392979431d6e210e0d6c4b42db62e8c6cf627

SHA512
cbaeb2424779f74cc4e9beac6736c2203e9355daef18b104a69891b4ff21764968d1579603b814aab95dd3be3d49699a1a1d052c6dc4e482a56138f04421d547

Download Submit
C:\Windows\win32.exe

Filesize
234KB

MD5
8f2019a565987246e2415731ebc93f04

SHA1
c7128fd0d550d56d52284c147117e8586dbe57f7

SHA256
c1bf61c435a53ada7dc888cc44a531f21bbb31073e0d970e8bfd1a69d170ce9c

SHA512
b0fb0f1127e9c2be5c7bafa4c7f141ac7bac98391e5e933b836b6abb3b9bcd470e50a434e3b33b1ab43aa13c5ff4988f4131e0f1247f44279f82eeb09ef2030c

Download Submit
C:\Windows\win32.exe

Filesize
234KB

MD5
a0d09225ecec2c7334158c5f6c76beb5

SHA1
26e1fc0501b36444b577763e25f14bacabbadf43

SHA256
df16008cf87048fba97ede2a73a992559e99bc3533b400ee3735d106fad38ef5

SHA512
1c0c77fc264150303220fcea631342544ba5a5e0c491e8a935ae63b61b6cd9845147925e85872ce1720bf4ea8c8c70b5747133b163b86e79a1f14b4795ea25cd

Download Submit
C:\Windows\win32.exe

Filesize
234KB

MD5
a0d09225ecec2c7334158c5f6c76beb5

SHA1
26e1fc0501b36444b577763e25f14bacabbadf43

SHA256
df16008cf87048fba97ede2a73a992559e99bc3533b400ee3735d106fad38ef5

SHA512
1c0c77fc264150303220fcea631342544ba5a5e0c491e8a935ae63b61b6cd9845147925e85872ce1720bf4ea8c8c70b5747133b163b86e79a1f14b4795ea25cd

Download Submit
C:\baca euy.txt

Filesize
4B

MD5
0ae9bcd0c0b0aa5aab99d84beca26ce8

SHA1
95ae2add76d30dc377e774ec0d5abc17a7832865

SHA256
91a4e2f100227487a802ac040b85700f03520b347fbfe4c23b7bf2d97b43d9fa

SHA512
2e5bce2521d799135a10bb14cc127a0f794d8cdd2bcd97ed90a7f2d4279f72abaf45a58daf7635472b3d845db21f13f03708fc40f89b1963c8344a89df2b3bd0

Download Submit
C:\baca euy.txt

Filesize
4B

MD5
0ae9bcd0c0b0aa5aab99d84beca26ce8

SHA1
95ae2add76d30dc377e774ec0d5abc17a7832865

SHA256
91a4e2f100227487a802ac040b85700f03520b347fbfe4c23b7bf2d97b43d9fa

SHA512
2e5bce2521d799135a10bb14cc127a0f794d8cdd2bcd97ed90a7f2d4279f72abaf45a58daf7635472b3d845db21f13f03708fc40f89b1963c8344a89df2b3bd0

Download Submit
C:\baca euy.txt

Filesize
4B

MD5
0ae9bcd0c0b0aa5aab99d84beca26ce8

SHA1
95ae2add76d30dc377e774ec0d5abc17a7832865

SHA256
91a4e2f100227487a802ac040b85700f03520b347fbfe4c23b7bf2d97b43d9fa

SHA512
2e5bce2521d799135a10bb14cc127a0f794d8cdd2bcd97ed90a7f2d4279f72abaf45a58daf7635472b3d845db21f13f03708fc40f89b1963c8344a89df2b3bd0

Download Submit
memory/112-203-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/556-181-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1792-192-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2092-187-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2132-171-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2132-225-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2664-220-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2736-221-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4780-167-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4780-223-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5036-224-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5036-168-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5080-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5080-222-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download