description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\""	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\""	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\""	inetinfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\""	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\""	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\""	winlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	inetinfo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts-Denied By-Admin.com	inetinfo.exe
File created	C:\Windows\System32\drivers\etc\hosts-Denied By-Admin.com	inetinfo.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif	smss.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif	smss.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Admin's Setting.scr	smss.exe
File opened for modification	C:\Windows\SysWOW64\Admin's Setting.scr	smss.exe

description	ioc	Process
File opened for modification	C:\Windows\eksplorasi.exe	inetinfo.exe
File opened for modification	C:\Windows\ShellNew\bronstab.exe	services.exe
File opened for modification	C:\Windows\eksplorasi.exe	services.exe
File opened for modification	C:\Windows\ShellNew\bronstab.exe	lsass.exe
File opened for modification	C:\Windows\eksplorasi.exe	lsass.exe
File opened for modification	C:\Windows\ShellNew\bronstab.exe	inetinfo.exe
File opened for modification	C:\Windows\ShellNew\bronstab.exe	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
File opened for modification	C:\Windows\eksplorasi.exe	smss.exe
File opened for modification	C:\Windows\ShellNew\bronstab.exe	winlogon.exe
File created	C:\Windows\eksplorasi.exe	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
File opened for modification	C:\Windows\ShellNew\bronstab.exe	smss.exe
File created	C:\Windows\ShellNew\bronstab.exe	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
File opened for modification	C:\Windows\eksplorasi.exe	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
File opened for modification	C:\Windows\eksplorasi.exe	winlogon.exe

pid	Process
4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe
5044	smss.exe
5016	winlogon.exe
2128	services.exe
3904	lsass.exe
4276	inetinfo.exe

description	pid	Process	procid_target
PID 4772 wrote to memory of 2360	4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe	79
PID 4772 wrote to memory of 2360	4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe	79
PID 4772 wrote to memory of 2360	4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe	79
PID 4772 wrote to memory of 5044	4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe	80
PID 4772 wrote to memory of 5044	4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe	80
PID 4772 wrote to memory of 5044	4772	a8dbd40709be3a20905a59a3f989835e3bbf8cd6e85cdc0566d74a04df3d3f37.exe	80
PID 5044 wrote to memory of 5016	5044	smss.exe	81
PID 5044 wrote to memory of 5016	5044	smss.exe	81
PID 5044 wrote to memory of 5016	5044	smss.exe	81
PID 5044 wrote to memory of 4652	5044	smss.exe	82
PID 5044 wrote to memory of 4652	5044	smss.exe	82
PID 5044 wrote to memory of 4652	5044	smss.exe	82
PID 5044 wrote to memory of 2220	5044	smss.exe	85
PID 5044 wrote to memory of 2220	5044	smss.exe	85
PID 5044 wrote to memory of 2220	5044	smss.exe	85
PID 5044 wrote to memory of 2128	5044	smss.exe	86
PID 5044 wrote to memory of 2128	5044	smss.exe	86
PID 5044 wrote to memory of 2128	5044	smss.exe	86
PID 5044 wrote to memory of 3904	5044	smss.exe	88
PID 5044 wrote to memory of 3904	5044	smss.exe	88
PID 5044 wrote to memory of 3904	5044	smss.exe	88
PID 5044 wrote to memory of 4276	5044	smss.exe	89
PID 5044 wrote to memory of 4276	5044	smss.exe	89
PID 5044 wrote to memory of 4276	5044	smss.exe	89

Analysis

Sharing