221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Size

85KB
MD5

309ae2acd5b2b3f16f93469ed229ae40
SHA1

fc01d5aecabd221a0cb6429f73238ef6e746c40c
SHA256

221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156
SHA512

49aed67b853694903ba5f8e4c6b619798bafecf8ad0975db580aeff9b26eadb96e6174db7b7d04e0077fe76aa292faaa6f8ca77231beb8863c07a30403bddf63
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5vXwekfpb:NHsxFJfgaDjofVKn1pGwTJOlw1Ur3wlb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
5060	Tiwi.exe
3844	IExplorer.exe
4844	winlogon.exe
4140	Tiwi.exe
2008	Tiwi.exe
4744	IExplorer.exe
4756	IExplorer.exe
4920	imoet.exe
2244	winlogon.exe
2140	winlogon.exe
1028	imoet.exe
640	imoet.exe
4392	cute.exe
3248	cute.exe
3916	cute.exe
2540	Tiwi.exe
2888	Tiwi.exe
3948	Tiwi.exe
1828	IExplorer.exe
1388	IExplorer.exe
3428	IExplorer.exe
2424	winlogon.exe
756	winlogon.exe
1780	winlogon.exe
3884	imoet.exe
4088	imoet.exe
1468	imoet.exe
1456	cute.exe
1592	cute.exe
3720	cute.exe
4940	Tiwi.exe
2720	IExplorer.exe
3932	winlogon.exe
3468	imoet.exe
1668	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1932-134-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e64-136.dat	upx
behavioral2/files/0x0006000000022e64-137.dat	upx
behavioral2/files/0x0006000000022e68-141.dat	upx
behavioral2/files/0x0006000000022e68-142.dat	upx
behavioral2/memory/5060-145-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3844-146-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e6a-148.dat	upx
behavioral2/files/0x0006000000022e6a-149.dat	upx
behavioral2/files/0x0006000000022e6b-151.dat	upx
behavioral2/files/0x0006000000022e67-158.dat	upx
behavioral2/files/0x0006000000022e66-157.dat	upx
behavioral2/files/0x0006000000022e6d-162.dat	upx
behavioral2/files/0x0006000000022e69-166.dat	upx
behavioral2/memory/4844-188-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e64-191.dat	upx
behavioral2/memory/4140-190-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e68-197.dat	upx
behavioral2/memory/4140-198-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2008-202-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e68-203.dat	upx
behavioral2/memory/4744-207-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4756-211-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e6b-210.dat	upx
behavioral2/files/0x0006000000022e6a-212.dat	upx
behavioral2/files/0x0006000000022e6a-219.dat	upx
behavioral2/memory/2244-218-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e64-183.dat	upx
behavioral2/files/0x0006000000022e69-179.dat	upx
behavioral2/files/0x0006000000022e65-178.dat	upx
behavioral2/files/0x0006000000022e67-177.dat	upx
behavioral2/files/0x0006000000022e6d-176.dat	upx
behavioral2/files/0x0006000000022e6b-175.dat	upx
behavioral2/files/0x0006000000022e6c-174.dat	upx
behavioral2/files/0x0006000000022e6c-173.dat	upx
behavioral2/files/0x0006000000022e6c-172.dat	upx
behavioral2/files/0x0006000000022e6b-169.dat	upx
behavioral2/files/0x0006000000022e6b-168.dat	upx
behavioral2/files/0x0006000000022e69-167.dat	upx
behavioral2/files/0x0006000000022e67-165.dat	upx
behavioral2/files/0x0006000000022e66-164.dat	upx
behavioral2/files/0x0006000000022e65-163.dat	upx
behavioral2/files/0x0006000000022e6b-223.dat	upx
behavioral2/files/0x0006000000022e6c-161.dat	upx
behavioral2/files/0x0006000000022e6b-160.dat	upx
behavioral2/files/0x0006000000022e69-159.dat	upx
behavioral2/files/0x0006000000022e65-156.dat	upx
behavioral2/files/0x0006000000022e67-155.dat	upx
behavioral2/files/0x0006000000022e66-154.dat	upx
behavioral2/files/0x0006000000022e6d-152.dat	upx
behavioral2/files/0x0006000000022e6c-150.dat	upx
behavioral2/files/0x0006000000022e65-153.dat	upx
behavioral2/memory/2140-224-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e6b-229.dat	upx
behavioral2/files/0x0006000000022e6c-230.dat	upx
behavioral2/files/0x0006000000022e6c-235.dat	upx
behavioral2/memory/1028-232-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/640-240-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3248-244-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e6c-243.dat	upx
behavioral2/memory/4920-242-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4392-245-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e66-249.dat	upx
behavioral2/memory/3248-246-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
4140	Tiwi.exe
2008	Tiwi.exe
2540	Tiwi.exe
3948	Tiwi.exe
2888	Tiwi.exe
4940	Tiwi.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\O:	imoet.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\N:	imoet.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\R:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\W:	cute.exe
File opened (read-only)	\??\I:	imoet.exe
File opened (read-only)	\??\P:	Tiwi.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\U:	cute.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\K:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\U:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\U:	Tiwi.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\Z:	cute.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\U:	imoet.exe
File opened (read-only)	\??\T:	imoet.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\F:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\X:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\Y:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\T:	cute.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\I:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\O:	cute.exe
File opened (read-only)	\??\U:	IExplorer.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\I:	cute.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\R:	cute.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\S:	cute.exe
File opened (read-only)	\??\Z:	Tiwi.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\H:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\Z:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	IExplorer.exe
File opened for modification	C:\autorun.inf	IExplorer.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\tiwi.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\SwapMouseButtons = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Tiwi"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Tiwi"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Mouse\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\	IExplorer.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
5060	Tiwi.exe
4920	imoet.exe
4844	winlogon.exe
3844	IExplorer.exe
4392	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
5060	Tiwi.exe
3844	IExplorer.exe
4844	winlogon.exe
4140	Tiwi.exe
2008	Tiwi.exe
4744	IExplorer.exe
4756	IExplorer.exe
2244	winlogon.exe
4920	imoet.exe
2140	winlogon.exe
1028	imoet.exe
640	imoet.exe
4392	cute.exe
3248	cute.exe
3916	cute.exe
2540	Tiwi.exe
3948	Tiwi.exe
2888	Tiwi.exe
1828	IExplorer.exe
1388	IExplorer.exe
3428	IExplorer.exe
2424	winlogon.exe
756	winlogon.exe
1780	winlogon.exe
3884	imoet.exe
1468	imoet.exe
4088	imoet.exe
1456	cute.exe
1592	cute.exe
3720	cute.exe
4940	Tiwi.exe
2720	IExplorer.exe
3932	winlogon.exe
3468	imoet.exe
1668	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 5060	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	80
PID 1932 wrote to memory of 5060	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	80
PID 1932 wrote to memory of 5060	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	80
PID 1932 wrote to memory of 3844	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	81
PID 1932 wrote to memory of 3844	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	81
PID 1932 wrote to memory of 3844	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	81
PID 1932 wrote to memory of 4844	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	82
PID 1932 wrote to memory of 4844	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	82
PID 1932 wrote to memory of 4844	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	82
PID 3844 wrote to memory of 4140	3844	IExplorer.exe	90
PID 3844 wrote to memory of 4140	3844	IExplorer.exe	90
PID 3844 wrote to memory of 4140	3844	IExplorer.exe	90
PID 5060 wrote to memory of 2008	5060	Tiwi.exe	89
PID 5060 wrote to memory of 2008	5060	Tiwi.exe	89
PID 5060 wrote to memory of 2008	5060	Tiwi.exe	89
PID 3844 wrote to memory of 4744	3844	IExplorer.exe	84
PID 3844 wrote to memory of 4744	3844	IExplorer.exe	84
PID 3844 wrote to memory of 4744	3844	IExplorer.exe	84
PID 5060 wrote to memory of 4756	5060	Tiwi.exe	83
PID 5060 wrote to memory of 4756	5060	Tiwi.exe	83
PID 5060 wrote to memory of 4756	5060	Tiwi.exe	83
PID 3844 wrote to memory of 2244	3844	IExplorer.exe	88
PID 3844 wrote to memory of 2244	3844	IExplorer.exe	88
PID 3844 wrote to memory of 2244	3844	IExplorer.exe	88
PID 1932 wrote to memory of 4920	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	85
PID 1932 wrote to memory of 4920	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	85
PID 1932 wrote to memory of 4920	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	85
PID 5060 wrote to memory of 2140	5060	Tiwi.exe	86
PID 5060 wrote to memory of 2140	5060	Tiwi.exe	86
PID 5060 wrote to memory of 2140	5060	Tiwi.exe	86
PID 3844 wrote to memory of 1028	3844	IExplorer.exe	87
PID 3844 wrote to memory of 1028	3844	IExplorer.exe	87
PID 3844 wrote to memory of 1028	3844	IExplorer.exe	87
PID 1932 wrote to memory of 4392	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	91
PID 1932 wrote to memory of 4392	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	91
PID 1932 wrote to memory of 4392	1932	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	91
PID 5060 wrote to memory of 640	5060	Tiwi.exe	93
PID 5060 wrote to memory of 640	5060	Tiwi.exe	93
PID 5060 wrote to memory of 640	5060	Tiwi.exe	93
PID 3844 wrote to memory of 3248	3844	IExplorer.exe	92
PID 3844 wrote to memory of 3248	3844	IExplorer.exe	92
PID 3844 wrote to memory of 3248	3844	IExplorer.exe	92
PID 5060 wrote to memory of 3916	5060	Tiwi.exe	94
PID 5060 wrote to memory of 3916	5060	Tiwi.exe	94
PID 5060 wrote to memory of 3916	5060	Tiwi.exe	94
PID 4844 wrote to memory of 2540	4844	winlogon.exe	95
PID 4844 wrote to memory of 2540	4844	winlogon.exe	95
PID 4844 wrote to memory of 2540	4844	winlogon.exe	95
PID 4920 wrote to memory of 2888	4920	imoet.exe	96
PID 4920 wrote to memory of 2888	4920	imoet.exe	96
PID 4920 wrote to memory of 2888	4920	imoet.exe	96
PID 4392 wrote to memory of 3948	4392	cute.exe	97
PID 4392 wrote to memory of 3948	4392	cute.exe	97
PID 4392 wrote to memory of 3948	4392	cute.exe	97
PID 4844 wrote to memory of 1828	4844	winlogon.exe	98
PID 4844 wrote to memory of 1828	4844	winlogon.exe	98
PID 4844 wrote to memory of 1828	4844	winlogon.exe	98
PID 4392 wrote to memory of 1388	4392	cute.exe	99
PID 4392 wrote to memory of 1388	4392	cute.exe	99
PID 4392 wrote to memory of 1388	4392	cute.exe	99
PID 4920 wrote to memory of 3428	4920	imoet.exe	100
PID 4920 wrote to memory of 3428	4920	imoet.exe	100
PID 4920 wrote to memory of 3428	4920	imoet.exe	100
PID 4844 wrote to memory of 2424	4844	winlogon.exe	101

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
"C:\Users\Admin\AppData\Local\Temp\221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1932
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5060
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4756
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2008
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:640
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3916
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3844
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4744
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1028
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2244
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4140
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3248
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4844
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2540
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1828
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2424
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3884
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4920
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2888
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3428
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:756
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4088
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4392
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3948
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1388
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1780
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1468
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3720
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4940
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2720
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3932
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3468
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Tiwi.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
d73dcf58886ab75a2efce0c67cb73efa

SHA1
f770f5b9e9f56d11e0dddbd565673327c45214ea

SHA256
d632dcb0ac156ce019dd4c474df7e8f175418d1935bd5d985317c2e9baff9b11

SHA512
ac1a2e331e57e439f6f982a2667623879f5a42da89717dc73eab515f3c6453ee5fd76310f08d2bc9149a928878eda8ae721e53e571ad7c9c8e01cba8055f012c

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
05029fa87c91f7dec51028f0bbe2e5d4

SHA1
c8d3e1d4540f37e298b985e6efd2fa622df01f61

SHA256
fa2f6daeab30ead4c439074900f8e632fc328c1ecd06c1126a66c61d72de97f9

SHA512
512b6d5b0d8aa314fc46a770562915a4cf83defa3afe22f961a2f367d546ab0a6e90b91ddc446f3be95af995e662b2d381f74b95fb34bdb9490644b233ca9969

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
7375af138ada9af80a7b61fe51be413c

SHA1
852ecd98f871badbc725eb865b3f2624a06eea37

SHA256
9caf58eee908a6eec83821cae84a747575132f7f18ea4af6edd78ef54c9ebbc2

SHA512
82b4ab55e9eae994b19b8e50ffdbad60765d02768d810d45fbb6f411aa1e6d6e3ec05048bf7b95bc2c968421ac4eec88eefb062f477e65b1c2800eee2f675290

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
111b91d763c0549155216f7b47aed146

SHA1
06d6daa9f7d456924db07f24bafaf602e7cf6f04

SHA256
27f969bf2502b5998cce7664b12dd20d6d546dd98923a77091f809d735041541

SHA512
61d50b7578621960f352dbe4ba3db026ebd8c864a1988df6bdcff2c1891d8ac61384aacd3819b396ad114bcb69bf17a2b3dc8ffef7e47fd4486c87409f3fc06a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
ec1b73898552d19b410aaa48ae366e4f

SHA1
2c1b8b9f85ae8853013c9c77fa21a42f4aa70482

SHA256
38ccc42ebeb24651e7c1dd7118f36d44c477dd04be7f18fc088e3857677f35fa

SHA512
15797079cf82874560a292bae029641f537cab569beedb86f166a773f70efad1d235b07719afe4fbb0f9faff9c19814ff862a1891d4901c8111d4e09140b6ea9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
ec1b73898552d19b410aaa48ae366e4f

SHA1
2c1b8b9f85ae8853013c9c77fa21a42f4aa70482

SHA256
38ccc42ebeb24651e7c1dd7118f36d44c477dd04be7f18fc088e3857677f35fa

SHA512
15797079cf82874560a292bae029641f537cab569beedb86f166a773f70efad1d235b07719afe4fbb0f9faff9c19814ff862a1891d4901c8111d4e09140b6ea9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
6297282ea1dc729d7eff04cb088722d0

SHA1
f9f8de4bb5dfedb895ce6ed918e11c52ffe7e4f5

SHA256
0db4e824ed2576f2495f66a7108b336f20beb6f46631ddb99837ef9eeb0ddabe

SHA512
74efee38dfb84e56e0234e608ca8bd1d0d62abe03f4fc848198eed8abc129b6649bb973b9c21e1b1d8a72de0459e7225efb27252cdd2a84f2c662feeb2da604f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
309ae2acd5b2b3f16f93469ed229ae40

SHA1
fc01d5aecabd221a0cb6429f73238ef6e746c40c

SHA256
221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156

SHA512
49aed67b853694903ba5f8e4c6b619798bafecf8ad0975db580aeff9b26eadb96e6174db7b7d04e0077fe76aa292faaa6f8ca77231beb8863c07a30403bddf63

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
e3af8a015cf1641bb8513c35622007db

SHA1
014d788f90c3ba1050c1229eb10d821236b75963

SHA256
a9c63339a51fac0d240e948b4b209974baf5a3bc4792841bc9bd2c0694bc285b

SHA512
712a5b40ea1614708439c1b2d1b84d05929945c3c0ddd3a9487f5bb128f5ea8b8922e4cd011b0dff281648a4d39eaf52503e93bb86a813579a7f22f8a0bfcd8a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
e3af8a015cf1641bb8513c35622007db

SHA1
014d788f90c3ba1050c1229eb10d821236b75963

SHA256
a9c63339a51fac0d240e948b4b209974baf5a3bc4792841bc9bd2c0694bc285b

SHA512
712a5b40ea1614708439c1b2d1b84d05929945c3c0ddd3a9487f5bb128f5ea8b8922e4cd011b0dff281648a4d39eaf52503e93bb86a813579a7f22f8a0bfcd8a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
e3af8a015cf1641bb8513c35622007db

SHA1
014d788f90c3ba1050c1229eb10d821236b75963

SHA256
a9c63339a51fac0d240e948b4b209974baf5a3bc4792841bc9bd2c0694bc285b

SHA512
712a5b40ea1614708439c1b2d1b84d05929945c3c0ddd3a9487f5bb128f5ea8b8922e4cd011b0dff281648a4d39eaf52503e93bb86a813579a7f22f8a0bfcd8a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
e3af8a015cf1641bb8513c35622007db

SHA1
014d788f90c3ba1050c1229eb10d821236b75963

SHA256
a9c63339a51fac0d240e948b4b209974baf5a3bc4792841bc9bd2c0694bc285b

SHA512
712a5b40ea1614708439c1b2d1b84d05929945c3c0ddd3a9487f5bb128f5ea8b8922e4cd011b0dff281648a4d39eaf52503e93bb86a813579a7f22f8a0bfcd8a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
309ae2acd5b2b3f16f93469ed229ae40

SHA1
fc01d5aecabd221a0cb6429f73238ef6e746c40c

SHA256
221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156

SHA512
49aed67b853694903ba5f8e4c6b619798bafecf8ad0975db580aeff9b26eadb96e6174db7b7d04e0077fe76aa292faaa6f8ca77231beb8863c07a30403bddf63

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
d468d2e3c86b282db616ce55b1c1d4f6

SHA1
6ca27284bab5051eb53f8a79231cf69ab7f0dd86

SHA256
ecce5d5ba241b84cf9c916496e9e8eea2471e09e468f4964570ea4c5671d1359

SHA512
a9b8df3cea1f3d6223c1105f2e3a0bccc80379142c3b6796b1c980f4a2ab9fb9d0b3a11f68859770b7a889185b31a190c25f8d6905e8deffc3ebd2a1a8f10537

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
386d6da374315d143e79977789fa7acb

SHA1
e4006670d8a51f842dc00010900356f0d3c7bfc1

SHA256
bd8879439ac34e74acdbaa6f77950b71d61779fb74b6033d515382aca23f4a91

SHA512
4728c917eef25088244db0ba494a0bf0b39828444b6f639efc298d4f9b9931ad7abc2979747c937883f872346721d04a59e4c9ef8db5c12f287a0066e1b8b3b6

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
309ae2acd5b2b3f16f93469ed229ae40

SHA1
fc01d5aecabd221a0cb6429f73238ef6e746c40c

SHA256
221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156

SHA512
49aed67b853694903ba5f8e4c6b619798bafecf8ad0975db580aeff9b26eadb96e6174db7b7d04e0077fe76aa292faaa6f8ca77231beb8863c07a30403bddf63

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
c19b21cdfd93d7a90bfc70cf6e2d4951

SHA1
222d8cd7985ba4f6a85ef94d2fcd1ca13a06319b

SHA256
2c3dd541714fd9f8a0deb97715f048ea3c9aa2070eded8137ab42e25166fa79c

SHA512
554954cee718c4f520f100103b2cfb50d615eada56a0995159d73afd486e1232e30a5376b8f2670514c2119eda7cf89088a3255ad7239bf88efee2d29ad2d618

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
c19b21cdfd93d7a90bfc70cf6e2d4951

SHA1
222d8cd7985ba4f6a85ef94d2fcd1ca13a06319b

SHA256
2c3dd541714fd9f8a0deb97715f048ea3c9aa2070eded8137ab42e25166fa79c

SHA512
554954cee718c4f520f100103b2cfb50d615eada56a0995159d73afd486e1232e30a5376b8f2670514c2119eda7cf89088a3255ad7239bf88efee2d29ad2d618

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
309ae2acd5b2b3f16f93469ed229ae40

SHA1
fc01d5aecabd221a0cb6429f73238ef6e746c40c

SHA256
221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156

SHA512
49aed67b853694903ba5f8e4c6b619798bafecf8ad0975db580aeff9b26eadb96e6174db7b7d04e0077fe76aa292faaa6f8ca77231beb8863c07a30403bddf63

Download Submit
C:\Windows\Tiwi.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
13b4794839cec81f270ed1038415c482

SHA1
c9ffc12e7dcc3231b26352e52a388b1653bdd533

SHA256
1d250389f6b926a763f869a2b7e436485ce9fac17c1017810a589b957b881aca

SHA512
11fe5d13227044ee317dd8b21a45f50f90b59d28576538600471a863c3647beeb30c27eba8602e0d3927a15a4b156be22ce6856abda73b2977cc9693e4a5161c

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
5ccde0657b3dc5cc10f5d2561774f83d

SHA1
05d9af97876ffde338f86f9663f071dfefc8b5ca

SHA256
46511027dbdc3650249c370737875e5bae5a56259e4119df4c9ad09a208c4655

SHA512
a3521e47952089e9fe39e392d4db0df07086972d81d24e6f4b1a0432d8c92b1535d8cb247d98c468783f5fe7f71639d0e26f6f6051937d01f41be77ce076a056

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
6a0a64d31fa767f59e28116a77d3dcb3

SHA1
4370d3a321276f1bf67cca57933d4ec62a410595

SHA256
0ef281d77fda52bdc4db51df4cd88084529d29d0b7f973ae3e577a46a477278b

SHA512
eaa6b43735d73a1e2bc0acf3c02563aac387b816d93cce97fe34f298205c60d81650281eebfec8e4a1d39827f5cfba85a379c508a51354f1c221a66a0b44e8a0

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
6a0a64d31fa767f59e28116a77d3dcb3

SHA1
4370d3a321276f1bf67cca57933d4ec62a410595

SHA256
0ef281d77fda52bdc4db51df4cd88084529d29d0b7f973ae3e577a46a477278b

SHA512
eaa6b43735d73a1e2bc0acf3c02563aac387b816d93cce97fe34f298205c60d81650281eebfec8e4a1d39827f5cfba85a379c508a51354f1c221a66a0b44e8a0

Download Submit
memory/640-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1780-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2140-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-271-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2888-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2888-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3720-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3844-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3844-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3932-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3948-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4744-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4756-211-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4844-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4844-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download