6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Size

85KB
MD5

a039294b6e71db573859902b915b9976
SHA1

ce7f0f77d960412040c75f614f1df24e7be1afb3
SHA256

6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971
SHA512

bea65f7ece72e94cabfe4ea07340a7a85ceeaa5ebfb9a71c8a98b1dba1acaa19ff2c760baa849102cb85657690ca327ff6657da28dcd44d9a8594fba9afd67e3
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5cXwekfp:NHsxFJfgaDjofVKn1pGwTJOlw1UrAwl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 30 IoCs

pid	Process
1752	Tiwi.exe
1980	IExplorer.exe
1416	winlogon.exe
1892	imoet.exe
1316	cute.exe
1656	Tiwi.exe
808	Tiwi.exe
1304	Tiwi.exe
1248	IExplorer.exe
1684	IExplorer.exe
1176	Tiwi.exe
1664	IExplorer.exe
1616	Tiwi.exe
964	winlogon.exe
2032	winlogon.exe
1724	winlogon.exe
568	IExplorer.exe
584	IExplorer.exe
1196	imoet.exe
2036	imoet.exe
1532	cute.exe
544	cute.exe
1188	winlogon.exe
1004	winlogon.exe
320	imoet.exe
1412	imoet.exe
1792	imoet.exe
296	cute.exe
1388	cute.exe
1828	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1016-57-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000014159-60.dat	upx
behavioral1/files/0x00060000000142cb-64.dat	upx
behavioral1/files/0x00060000000142cb-65.dat	upx
behavioral1/files/0x00060000000142cb-67.dat	upx
behavioral1/files/0x00060000000142e0-71.dat	upx
behavioral1/files/0x00060000000142e0-72.dat	upx
behavioral1/files/0x00060000000142e0-74.dat	upx
behavioral1/files/0x0006000000014330-78.dat	upx
behavioral1/files/0x0006000000014330-79.dat	upx
behavioral1/files/0x0006000000014330-81.dat	upx
behavioral1/files/0x0006000000014371-85.dat	upx
behavioral1/files/0x0006000000014371-86.dat	upx
behavioral1/files/0x0006000000014371-88.dat	upx
behavioral1/memory/1016-92-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000014495-107.dat	upx
behavioral1/files/0x0006000000014236-114.dat	upx
behavioral1/files/0x000600000001420e-113.dat	upx
behavioral1/files/0x00060000000142d6-119.dat	upx
behavioral1/files/0x00060000000142d6-124.dat	upx
behavioral1/files/0x0006000000014159-130.dat	upx
behavioral1/files/0x000600000001420e-127.dat	upx
behavioral1/files/0x0006000000014159-137.dat	upx
behavioral1/files/0x0006000000014495-126.dat	upx
behavioral1/files/0x00060000000142d6-134.dat	upx
behavioral1/files/0x0006000000014248-133.dat	upx
behavioral1/files/0x0006000000014159-132.dat	upx
behavioral1/files/0x0006000000014248-123.dat	upx
behavioral1/files/0x0006000000014248-118.dat	upx
behavioral1/files/0x0006000000014236-117.dat	upx
behavioral1/files/0x000600000001420e-116.dat	upx
behavioral1/files/0x0006000000014495-115.dat	upx
behavioral1/files/0x00060000000142d6-111.dat	upx
behavioral1/files/0x0006000000014248-110.dat	upx
behavioral1/files/0x0006000000014236-109.dat	upx
behavioral1/files/0x000600000001420e-108.dat	upx
behavioral1/files/0x00060000000142d6-106.dat	upx
behavioral1/files/0x00060000000142d6-105.dat	upx
behavioral1/files/0x0006000000014248-104.dat	upx
behavioral1/files/0x0006000000014236-103.dat	upx
behavioral1/files/0x000600000001420e-102.dat	upx
behavioral1/files/0x0006000000014248-101.dat	upx
behavioral1/files/0x00060000000142cb-100.dat	upx
behavioral1/files/0x0006000000014236-99.dat	upx
behavioral1/files/0x000600000001420e-98.dat	upx
behavioral1/files/0x0006000000014159-97.dat	upx
behavioral1/files/0x0006000000014495-96.dat	upx
behavioral1/files/0x0006000000014330-95.dat	upx
behavioral1/files/0x0006000000014371-94.dat	upx
behavioral1/files/0x00060000000142e0-93.dat	upx
behavioral1/files/0x0006000000014236-140.dat	upx
behavioral1/files/0x0006000000014236-142.dat	upx
behavioral1/files/0x00060000000142cb-149.dat	upx
behavioral1/files/0x00060000000142cb-146.dat	upx
behavioral1/files/0x0006000000014248-143.dat	upx
behavioral1/memory/1752-156-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1316-168-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1892-167-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1248-166-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1416-165-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1980-164-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1304-163-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/808-162-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1656-161-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 45 IoCs

pid	Process
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1416	winlogon.exe
1416	winlogon.exe
1980	IExplorer.exe
1980	IExplorer.exe
1752	Tiwi.exe
1752	Tiwi.exe
1416	winlogon.exe
1752	Tiwi.exe
1752	Tiwi.exe
1980	IExplorer.exe
1980	IExplorer.exe
1892	imoet.exe
1892	imoet.exe
1316	cute.exe
1316	cute.exe
1752	Tiwi.exe
1752	Tiwi.exe
1980	IExplorer.exe
1980	IExplorer.exe
1980	IExplorer.exe
1752	Tiwi.exe
1980	IExplorer.exe
1752	Tiwi.exe
1316	cute.exe
1892	imoet.exe
1316	cute.exe
1892	imoet.exe
1892	imoet.exe
1316	cute.exe
1316	cute.exe
1416	winlogon.exe
1416	winlogon.exe
1892	imoet.exe
1892	imoet.exe
1316	cute.exe
1416	winlogon.exe
1416	winlogon.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\F:	imoet.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\N:	cute.exe
File opened (read-only)	\??\Y:	cute.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\I:	Tiwi.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\V:	imoet.exe
File opened (read-only)	\??\K:	cute.exe
File opened (read-only)	\??\X:	cute.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\K:	imoet.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\I:	cute.exe
File opened (read-only)	\??\T:	cute.exe
File opened (read-only)	\??\W:	winlogon.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\Z:	IExplorer.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\Z:	imoet.exe
File opened (read-only)	\??\F:	IExplorer.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\X:	Tiwi.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\R:	cute.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\G:	Tiwi.exe
File opened (read-only)	\??\U:	Tiwi.exe
File opened (read-only)	\??\M:	Tiwi.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\W:	cute.exe
File opened (read-only)	\??\E:	winlogon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\X:	imoet.exe
File opened (read-only)	\??\L:	cute.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\Z:	cute.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\N:	imoet.exe
File opened (read-only)	\??\Z:	winlogon.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\J:	Tiwi.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\S:	cute.exe
File opened (read-only)	\??\U:	cute.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	IExplorer.exe
File opened for modification	C:\autorun.inf	IExplorer.exe
File created	C:\autorun.inf	Tiwi.exe
File opened for modification	C:\autorun.inf	Tiwi.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shell.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\tiwi.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1752	Tiwi.exe
1892	imoet.exe
1416	winlogon.exe
1980	IExplorer.exe
1316	cute.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
1752	Tiwi.exe
1980	IExplorer.exe
1416	winlogon.exe
1892	imoet.exe
1316	cute.exe
808	Tiwi.exe
1656	Tiwi.exe
1304	Tiwi.exe
1248	IExplorer.exe
1664	IExplorer.exe
1684	IExplorer.exe
1176	Tiwi.exe
1616	Tiwi.exe
964	winlogon.exe
2032	winlogon.exe
1724	winlogon.exe
568	IExplorer.exe
1196	imoet.exe
2036	imoet.exe
584	IExplorer.exe
1188	winlogon.exe
544	cute.exe
1004	winlogon.exe
1532	cute.exe
320	imoet.exe
1412	imoet.exe
1792	imoet.exe
296	cute.exe
1388	cute.exe
1828	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1752	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	27
PID 1016 wrote to memory of 1752	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	27
PID 1016 wrote to memory of 1752	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	27
PID 1016 wrote to memory of 1752	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	27
PID 1016 wrote to memory of 1980	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	28
PID 1016 wrote to memory of 1980	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	28
PID 1016 wrote to memory of 1980	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	28
PID 1016 wrote to memory of 1980	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	28
PID 1016 wrote to memory of 1416	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	29
PID 1016 wrote to memory of 1416	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	29
PID 1016 wrote to memory of 1416	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	29
PID 1016 wrote to memory of 1416	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	29
PID 1016 wrote to memory of 1892	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	30
PID 1016 wrote to memory of 1892	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	30
PID 1016 wrote to memory of 1892	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	30
PID 1016 wrote to memory of 1892	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	30
PID 1016 wrote to memory of 1316	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	31
PID 1016 wrote to memory of 1316	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	31
PID 1016 wrote to memory of 1316	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	31
PID 1016 wrote to memory of 1316	1016	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	31
PID 1752 wrote to memory of 1656	1752	Tiwi.exe	32
PID 1752 wrote to memory of 1656	1752	Tiwi.exe	32
PID 1752 wrote to memory of 1656	1752	Tiwi.exe	32
PID 1752 wrote to memory of 1656	1752	Tiwi.exe	32
PID 1416 wrote to memory of 808	1416	winlogon.exe	34
PID 1416 wrote to memory of 808	1416	winlogon.exe	34
PID 1416 wrote to memory of 808	1416	winlogon.exe	34
PID 1416 wrote to memory of 808	1416	winlogon.exe	34
PID 1980 wrote to memory of 1304	1980	IExplorer.exe	33
PID 1980 wrote to memory of 1304	1980	IExplorer.exe	33
PID 1980 wrote to memory of 1304	1980	IExplorer.exe	33
PID 1980 wrote to memory of 1304	1980	IExplorer.exe	33
PID 1416 wrote to memory of 1248	1416	winlogon.exe	35
PID 1416 wrote to memory of 1248	1416	winlogon.exe	35
PID 1416 wrote to memory of 1248	1416	winlogon.exe	35
PID 1416 wrote to memory of 1248	1416	winlogon.exe	35
PID 1316 wrote to memory of 1176	1316	cute.exe	39
PID 1316 wrote to memory of 1176	1316	cute.exe	39
PID 1316 wrote to memory of 1176	1316	cute.exe	39
PID 1316 wrote to memory of 1176	1316	cute.exe	39
PID 1980 wrote to memory of 1664	1980	IExplorer.exe	38
PID 1980 wrote to memory of 1664	1980	IExplorer.exe	38
PID 1980 wrote to memory of 1664	1980	IExplorer.exe	38
PID 1980 wrote to memory of 1664	1980	IExplorer.exe	38
PID 1752 wrote to memory of 1684	1752	Tiwi.exe	37
PID 1752 wrote to memory of 1684	1752	Tiwi.exe	37
PID 1752 wrote to memory of 1684	1752	Tiwi.exe	37
PID 1752 wrote to memory of 1684	1752	Tiwi.exe	37
PID 1892 wrote to memory of 1616	1892	imoet.exe	36
PID 1892 wrote to memory of 1616	1892	imoet.exe	36
PID 1892 wrote to memory of 1616	1892	imoet.exe	36
PID 1892 wrote to memory of 1616	1892	imoet.exe	36
PID 1416 wrote to memory of 964	1416	winlogon.exe	40
PID 1416 wrote to memory of 964	1416	winlogon.exe	40
PID 1416 wrote to memory of 964	1416	winlogon.exe	40
PID 1416 wrote to memory of 964	1416	winlogon.exe	40
PID 1752 wrote to memory of 2032	1752	Tiwi.exe	41
PID 1752 wrote to memory of 2032	1752	Tiwi.exe	41
PID 1752 wrote to memory of 2032	1752	Tiwi.exe	41
PID 1752 wrote to memory of 2032	1752	Tiwi.exe	41
PID 1980 wrote to memory of 1724	1980	IExplorer.exe	42
PID 1980 wrote to memory of 1724	1980	IExplorer.exe	42
PID 1980 wrote to memory of 1724	1980	IExplorer.exe	42
PID 1980 wrote to memory of 1724	1980	IExplorer.exe	42

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe

C:\Users\Admin\AppData\Local\Temp\6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
"C:\Users\Admin\AppData\Local\Temp\6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1752
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1684
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1196
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:544
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1980
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1304
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1664
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2036
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1416
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:808
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1248
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1892
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:568
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1004
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:320
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:296
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1316
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:584
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1188
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1412
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
6da884ba0aec7ae9d2361479411a492c

SHA1
2b9b177f3f39eee72f0a630f342a42b70889a592

SHA256
55ef402f9fee1d11587f517f5229a0a61c1f9d3c7ecd446d4f8a2a68f17c4b15

SHA512
8f45a513b110be34b7b1e361dd151198677e8a6bc32f873cdbbf9290dccde7b8433c515b2b6f982631de0cd717b4b72c5585bf891c1d93290df0a676534eaf18

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
3cf95afa0e23112687af7cab9edac7ab

SHA1
52fb15508c35b4c1360428e6ad9338d0a24418fd

SHA256
34ded69ba8ffc83125e71b27678b26a0dbf815cb7279e441e2151118bead28a0

SHA512
e351a5cb68f004c5f4bb5476a374244af3733833dcb904410726c05937f1cdedc0738d38d64d094f8c15e08ba7dc478ec9da0ac5ae99836f3692acbc57b59a28

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
09565bf1d139ec36c398cf6f4de97b1d

SHA1
514ccfe96a5462c8d299c573df839b570ee779d5

SHA256
e42ca4b6dda4f5e96f8a7ed1efa7f219721642114dd8afd1a2128c9260d596fd

SHA512
33f7af4c65fe7a422425d12523ac70e5d3f0ab01d40b7bd5f7e76e07d7502c1fe974de939bab798017a4f4e10796a882c865665c1b9a785585cf91510ddf3fef

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
6da884ba0aec7ae9d2361479411a492c

SHA1
2b9b177f3f39eee72f0a630f342a42b70889a592

SHA256
55ef402f9fee1d11587f517f5229a0a61c1f9d3c7ecd446d4f8a2a68f17c4b15

SHA512
8f45a513b110be34b7b1e361dd151198677e8a6bc32f873cdbbf9290dccde7b8433c515b2b6f982631de0cd717b4b72c5585bf891c1d93290df0a676534eaf18

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
3cf95afa0e23112687af7cab9edac7ab

SHA1
52fb15508c35b4c1360428e6ad9338d0a24418fd

SHA256
34ded69ba8ffc83125e71b27678b26a0dbf815cb7279e441e2151118bead28a0

SHA512
e351a5cb68f004c5f4bb5476a374244af3733833dcb904410726c05937f1cdedc0738d38d64d094f8c15e08ba7dc478ec9da0ac5ae99836f3692acbc57b59a28

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
94f6640f749a277d33bf6ed369571d2f

SHA1
c9a71eb3c0a1ddfe0187235f4aeb22a85adcd3f1

SHA256
e4bbbf23d44b648f685ef0756a89bb1eaebbac52ad07625a06f3756fc546fdb4

SHA512
6951ab317aa384820b760e914704f5ead36e0d087e84b712ab5995110cc4f653236ea3a6be4574172e3f59231bb33652ca27467d188d3bae3b1c07bb2a971d8d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
a152de193f6bcb7a174b39eb4364da75

SHA1
ff00667d83dd51f440bafdd903d5051949d11e76

SHA256
81891592667a9cefdcb357eace478f6e707e054e7380f4317aae1ad169f99c5b

SHA512
40e31cba881e370b84b9295de0504633b02124cdfe93eecd4462595cdae9ccc3165965f684e54954d95a000c3e10cc68a2d918abb10f6734c36412bda129cf31

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
3e8c40a5ec79b5e8b795aacc7d237c3f

SHA1
cdcacd891998b48f0613ae0c78e78b9583291288

SHA256
86198c73ad809f653d859998898d4c1b139f7056676c5fe030985a33d544b1e7

SHA512
5bc6eeddfb33c5c881109d773176537522a69d1a1b9cebab6fff4e322967500e12ae1d996bc6871223f982daa7e2ee38a695ae2f24ca0e2c777104fb196b8f10

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
d60d7310351a53f4a73dcac693cb3d4f

SHA1
a7adb215891b0b800042abc4863f3493464297a5

SHA256
cb63db8cdb169792db8d27d313bef20f28c9e505d0b7b436456d084c70d09e62

SHA512
d377a55fe36bc3aa56ce742915aeb02ec4d911364943d03bf6c0711a70f643a869823216eb08cfcb962b9e32b4618f583f08dd8458d2f06aba3a32f34656be66

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
09565bf1d139ec36c398cf6f4de97b1d

SHA1
514ccfe96a5462c8d299c573df839b570ee779d5

SHA256
e42ca4b6dda4f5e96f8a7ed1efa7f219721642114dd8afd1a2128c9260d596fd

SHA512
33f7af4c65fe7a422425d12523ac70e5d3f0ab01d40b7bd5f7e76e07d7502c1fe974de939bab798017a4f4e10796a882c865665c1b9a785585cf91510ddf3fef

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
09565bf1d139ec36c398cf6f4de97b1d

SHA1
514ccfe96a5462c8d299c573df839b570ee779d5

SHA256
e42ca4b6dda4f5e96f8a7ed1efa7f219721642114dd8afd1a2128c9260d596fd

SHA512
33f7af4c65fe7a422425d12523ac70e5d3f0ab01d40b7bd5f7e76e07d7502c1fe974de939bab798017a4f4e10796a882c865665c1b9a785585cf91510ddf3fef

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
09565bf1d139ec36c398cf6f4de97b1d

SHA1
514ccfe96a5462c8d299c573df839b570ee779d5

SHA256
e42ca4b6dda4f5e96f8a7ed1efa7f219721642114dd8afd1a2128c9260d596fd

SHA512
33f7af4c65fe7a422425d12523ac70e5d3f0ab01d40b7bd5f7e76e07d7502c1fe974de939bab798017a4f4e10796a882c865665c1b9a785585cf91510ddf3fef

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
b3330543da6d573fd22328ad38b56d5e

SHA1
a693de30492b5beb953d0c76d1682f868975ea3c

SHA256
a97c342915ae1b80440b8e0a9bd3e433ab4dff74d4221f4dd4f6f8c4c68e35e0

SHA512
d44672249c9ae57f18e28e9b3a3c867f49b343fd4883a1947d6c33c2c11c1152b2a766924425c341fba64716172b0016a68ff824a5b9a7154d4b0f0d125e0555

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
b3330543da6d573fd22328ad38b56d5e

SHA1
a693de30492b5beb953d0c76d1682f868975ea3c

SHA256
a97c342915ae1b80440b8e0a9bd3e433ab4dff74d4221f4dd4f6f8c4c68e35e0

SHA512
d44672249c9ae57f18e28e9b3a3c867f49b343fd4883a1947d6c33c2c11c1152b2a766924425c341fba64716172b0016a68ff824a5b9a7154d4b0f0d125e0555

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
4bb842767112b770ff471170a471b33d

SHA1
932cef5c3e8790940f5001f0dbf77e42a3547102

SHA256
8818e1ae57ee5f2313ceab1098410f67ff4a4b3a495934ab08ac05fcccd74c94

SHA512
0cf995e8b7ad72f4f19b381c577c670e5583c0bcd88142dcc8b3b720806b0998af84b668bc9ddc5ef91b04cbd500a5a5e9cffe905ec079e29128075dbb10c310

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
2d9111c4e7cafd8951a8d4e77b3bb726

SHA1
29a7627bccabd2895008c7545f387eab77149d91

SHA256
31f229ff50d13e3016b1cf274a1a62d3c4476bac173dcf50983549f87d8ce2b9

SHA512
b1dbf0bbf9dfc866f84ec113cfbfb90c3156087dd0f99736a5e36d87ebf9b28cdc297ccbf948965b6aaa2aca733835a8bb9998f504cedaa9cb7be90d8a03568a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
2d9111c4e7cafd8951a8d4e77b3bb726

SHA1
29a7627bccabd2895008c7545f387eab77149d91

SHA256
31f229ff50d13e3016b1cf274a1a62d3c4476bac173dcf50983549f87d8ce2b9

SHA512
b1dbf0bbf9dfc866f84ec113cfbfb90c3156087dd0f99736a5e36d87ebf9b28cdc297ccbf948965b6aaa2aca733835a8bb9998f504cedaa9cb7be90d8a03568a

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
df5968d0b540d9cfe30a4ba5a1111325

SHA1
e292a4c5c78dc43dcaecc9b4085c05087b81c325

SHA256
33a399c96249f5d3cc77166f1e7facf6096b214415b8360733d439cc2de408d8

SHA512
d139711e31255cce85053d3be68b7c4b09f8fef68a3b568f35e3d90e6c2ea62aac18729f0b1f53f0567912a14808fbb5d905a5cb30f042cc763db65cd597a3f2

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
98e979728f2d4822f630de800bb16813

SHA1
696dc86dff1f8a8caa7cc0dd9d70dc673a816976

SHA256
0ce8a9cff92d3f2d285217ee362e5d33ee11973c74c114bd930c79f6add7a88e

SHA512
4cfd70ef28f260460a0e70ea10bb9dfe6bcc0b45df7d8156823c5e50d00aa6e4c424d5eac64a15393a588a76e132dca1b0760e7468895f14772bb3ce91b2213e

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
3cf95afa0e23112687af7cab9edac7ab

SHA1
52fb15508c35b4c1360428e6ad9338d0a24418fd

SHA256
34ded69ba8ffc83125e71b27678b26a0dbf815cb7279e441e2151118bead28a0

SHA512
e351a5cb68f004c5f4bb5476a374244af3733833dcb904410726c05937f1cdedc0738d38d64d094f8c15e08ba7dc478ec9da0ac5ae99836f3692acbc57b59a28

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
6da884ba0aec7ae9d2361479411a492c

SHA1
2b9b177f3f39eee72f0a630f342a42b70889a592

SHA256
55ef402f9fee1d11587f517f5229a0a61c1f9d3c7ecd446d4f8a2a68f17c4b15

SHA512
8f45a513b110be34b7b1e361dd151198677e8a6bc32f873cdbbf9290dccde7b8433c515b2b6f982631de0cd717b4b72c5585bf891c1d93290df0a676534eaf18

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
df5968d0b540d9cfe30a4ba5a1111325

SHA1
e292a4c5c78dc43dcaecc9b4085c05087b81c325

SHA256
33a399c96249f5d3cc77166f1e7facf6096b214415b8360733d439cc2de408d8

SHA512
d139711e31255cce85053d3be68b7c4b09f8fef68a3b568f35e3d90e6c2ea62aac18729f0b1f53f0567912a14808fbb5d905a5cb30f042cc763db65cd597a3f2

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
dd7b52cea5ecb4bb205e51112c378029

SHA1
2317b7d46da75a7a83ebcfdf08112af1e188f525

SHA256
de433e1a54ebf66ceba7aa30980ef455987a6ec96d79806271f9ae32f133e8fd

SHA512
6a45cf046d8047c9b405e804193b8ab3ac3e8b28ff2baf76c012da76d8ee5363b044e2ebb885c65d341a9d2b8bf933124ace0d10b2f3ed2ff5ebc76359c9f1e5

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
dd7b52cea5ecb4bb205e51112c378029

SHA1
2317b7d46da75a7a83ebcfdf08112af1e188f525

SHA256
de433e1a54ebf66ceba7aa30980ef455987a6ec96d79806271f9ae32f133e8fd

SHA512
6a45cf046d8047c9b405e804193b8ab3ac3e8b28ff2baf76c012da76d8ee5363b044e2ebb885c65d341a9d2b8bf933124ace0d10b2f3ed2ff5ebc76359c9f1e5

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
ef2aa3536183bd91a632eca038d1894b

SHA1
0b4c55da0753f431132572cb403e73c5471286db

SHA256
cd2b0d592e3eb972086bbd931097a37569c2716c382828f3eeb9a237c6399314

SHA512
82512a909e5273e034f24dc23de9d6ac4b8754dd418bd188f61c74debef0354d25eba7b1248459829a561216c80ae2a8375d058530d702ad82aa0e66ca74a943

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
d30cc1c698d8a8ec0d99542b78376561

SHA1
2cca3a6d4716421002d4d62b00994f76bdb2c0ba

SHA256
4d1c5c00b2f98da8e03496ddba70b7c6091e65de4c555c2a438972d5cfcf4312

SHA512
b73efa38ca6c975f5c046ae3ad1bc3ab087676adbb6e4b85a78140128efd67cdd3899cc4d23e06f9bc5d22a671e1a9d46121a7eef70973e69db794d5a406eaa5

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
d30cc1c698d8a8ec0d99542b78376561

SHA1
2cca3a6d4716421002d4d62b00994f76bdb2c0ba

SHA256
4d1c5c00b2f98da8e03496ddba70b7c6091e65de4c555c2a438972d5cfcf4312

SHA512
b73efa38ca6c975f5c046ae3ad1bc3ab087676adbb6e4b85a78140128efd67cdd3899cc4d23e06f9bc5d22a671e1a9d46121a7eef70973e69db794d5a406eaa5

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
bec414a8d0f386222e1e96507efe318b

SHA1
36623f76e7a2f657e2aa57ad679370d7fc8ec9cf

SHA256
e3b46b403e2ea6df37ee37eb6191f98021408f29ec5c745857791c8307c26496

SHA512
7ea5cfb888a604e70160442d30ec57bed165b90a6880060b712650c1540f551b86bf25ae1a43f3c3b899cd0370dca60990a4b06cab5478c886004688dcd5f125

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
c7ab95bd70111375d09e6448aeac8158

SHA1
b52f2744dc7b64e04a6cd39d11efc6a1a88cf0ff

SHA256
b0864a62c4db0d5b8579cdb96638141b0e32472f532df92edf02269342846a89

SHA512
6c4b2cd07c00204badd041dd10854a485a940c549ee806b520677148c09afb99530a78548b3550881da0ede6fa0d458b71c8dd7bffc497ae277b0066f88ecfe1

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
d92ef15de3b78283c438baf14e41c84f

SHA1
3111746b297dc636df8c0e66b4160920053fade7

SHA256
abe8adfb77753216b9928e03e33569a9a83d94940009f11add45d1bff636ce46

SHA512
341856e23b1fe6db7f0b30b8e1eb01ebd50bc9fff2de00a4880d7062741f1833f35a5e71672d7cc904a0dd96c7108335d45e0aa508eb54c1c94c62b834a6d49f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
f4ada40e6aabca0a19c427d28699ba01

SHA1
c771e28901ff986b09fdee5e712d9bc316708ae6

SHA256
3593c960ee6032a9a9c7bba24a42f67a6c21c4ecfe6a8bfa3b4c52c0c12dbf55

SHA512
e714f3441c1617a2f5d0b63d79c5aa3ff092a0329fbf7e74db3b9c5d0b6f1117c779528d52f86ecda2deb48435c9dedd20ddb10c991e5e0ecbbb7942cdb19227

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
f4ada40e6aabca0a19c427d28699ba01

SHA1
c771e28901ff986b09fdee5e712d9bc316708ae6

SHA256
3593c960ee6032a9a9c7bba24a42f67a6c21c4ecfe6a8bfa3b4c52c0c12dbf55

SHA512
e714f3441c1617a2f5d0b63d79c5aa3ff092a0329fbf7e74db3b9c5d0b6f1117c779528d52f86ecda2deb48435c9dedd20ddb10c991e5e0ecbbb7942cdb19227

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
1280e2149846e6b7426481a2272be7f7

SHA1
d0c35e8c82328e2c0e31ad9a17c52f741477f8f2

SHA256
bae131df52a43d1f7019c824eb5692ce2558695e5eab667d900c936d2e45fb2e

SHA512
701b5a80d3ceadaf1ad168659a6e92250a62d68f07fc982686d65a4f27c84798577bc6e4b54465d9d5304f7ad866b4ab378c68c7daebec255023a77ca0d24047

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
c7ab95bd70111375d09e6448aeac8158

SHA1
b52f2744dc7b64e04a6cd39d11efc6a1a88cf0ff

SHA256
b0864a62c4db0d5b8579cdb96638141b0e32472f532df92edf02269342846a89

SHA512
6c4b2cd07c00204badd041dd10854a485a940c549ee806b520677148c09afb99530a78548b3550881da0ede6fa0d458b71c8dd7bffc497ae277b0066f88ecfe1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
6da884ba0aec7ae9d2361479411a492c

SHA1
2b9b177f3f39eee72f0a630f342a42b70889a592

SHA256
55ef402f9fee1d11587f517f5229a0a61c1f9d3c7ecd446d4f8a2a68f17c4b15

SHA512
8f45a513b110be34b7b1e361dd151198677e8a6bc32f873cdbbf9290dccde7b8433c515b2b6f982631de0cd717b4b72c5585bf891c1d93290df0a676534eaf18

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
6da884ba0aec7ae9d2361479411a492c

SHA1
2b9b177f3f39eee72f0a630f342a42b70889a592

SHA256
55ef402f9fee1d11587f517f5229a0a61c1f9d3c7ecd446d4f8a2a68f17c4b15

SHA512
8f45a513b110be34b7b1e361dd151198677e8a6bc32f873cdbbf9290dccde7b8433c515b2b6f982631de0cd717b4b72c5585bf891c1d93290df0a676534eaf18

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
3cf95afa0e23112687af7cab9edac7ab

SHA1
52fb15508c35b4c1360428e6ad9338d0a24418fd

SHA256
34ded69ba8ffc83125e71b27678b26a0dbf815cb7279e441e2151118bead28a0

SHA512
e351a5cb68f004c5f4bb5476a374244af3733833dcb904410726c05937f1cdedc0738d38d64d094f8c15e08ba7dc478ec9da0ac5ae99836f3692acbc57b59a28

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
3cf95afa0e23112687af7cab9edac7ab

SHA1
52fb15508c35b4c1360428e6ad9338d0a24418fd

SHA256
34ded69ba8ffc83125e71b27678b26a0dbf815cb7279e441e2151118bead28a0

SHA512
e351a5cb68f004c5f4bb5476a374244af3733833dcb904410726c05937f1cdedc0738d38d64d094f8c15e08ba7dc478ec9da0ac5ae99836f3692acbc57b59a28

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
09565bf1d139ec36c398cf6f4de97b1d

SHA1
514ccfe96a5462c8d299c573df839b570ee779d5

SHA256
e42ca4b6dda4f5e96f8a7ed1efa7f219721642114dd8afd1a2128c9260d596fd

SHA512
33f7af4c65fe7a422425d12523ac70e5d3f0ab01d40b7bd5f7e76e07d7502c1fe974de939bab798017a4f4e10796a882c865665c1b9a785585cf91510ddf3fef

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
09565bf1d139ec36c398cf6f4de97b1d

SHA1
514ccfe96a5462c8d299c573df839b570ee779d5

SHA256
e42ca4b6dda4f5e96f8a7ed1efa7f219721642114dd8afd1a2128c9260d596fd

SHA512
33f7af4c65fe7a422425d12523ac70e5d3f0ab01d40b7bd5f7e76e07d7502c1fe974de939bab798017a4f4e10796a882c865665c1b9a785585cf91510ddf3fef

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
ace19ab449d8f56739051ebf7b958808

SHA1
b2df1a3c0736689a222a790d5c141f5a8e04dad4

SHA256
15ff2c06d4dcf264de34374a1f5f2a378e2d949557a0ccff657e4ae1b9c5cff0

SHA512
edec83bc94c50dc3a30381c687d0b249a1c3e828b46dd16c11d0d6986c48e4b1e5383248550a53db8888dd74ea2f14526825221b55a70c0189cfa4e418d36a9d

Download Submit
memory/296-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/296-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/544-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/544-228-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/568-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/584-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/808-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/964-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/964-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-227-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-56-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1016-59-0x00000000006D0000-0x0000000000703000-memory.dmp

Filesize
204KB

Download
memory/1176-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1304-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1316-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1316-263-0x00000000025A0000-0x00000000025D3000-memory.dmp

Filesize
204KB

Download
memory/1316-261-0x00000000025A0000-0x00000000025D3000-memory.dmp

Filesize
204KB

Download
memory/1316-260-0x00000000025A0000-0x00000000025D3000-memory.dmp

Filesize
204KB

Download
memory/1412-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1412-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-262-0x0000000001D00000-0x0000000001D33000-memory.dmp

Filesize
204KB

Download
memory/1416-246-0x0000000001D00000-0x0000000001D33000-memory.dmp

Filesize
204KB

Download
memory/1416-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-155-0x0000000001D00000-0x0000000001D33000-memory.dmp

Filesize
204KB

Download
memory/1532-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1664-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1752-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1752-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1892-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1892-219-0x0000000002580000-0x00000000025B3000-memory.dmp

Filesize
204KB

Download
memory/1980-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download