a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

Analysis

max time kernel
141s
max time network
165s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
Size

461KB
MD5

a24a3b0b05139f148ccc7ca0af3483c1
SHA1

367089a4d30d9015fc17a62e3f03054be51dc8b2
SHA256

a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187
SHA512

abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8
SSDEEP

3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1900 winlogon.exe
976 winlogon.exe
1532 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1900	winlogon.exe
976	winlogon.exe
1532	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmias.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdll.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findviru.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamserv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fslaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostinstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bd_professional.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcciomon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efinet32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netinfo.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unzip.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallControlPanel.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ewido.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepsrv.sys.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winroute.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprotect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pview95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe	winlogon.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1648-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1648-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1648-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1648-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1648-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1648-67-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1648-72-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/976-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1532-89-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1532-93-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1532-94-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1532-98-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/976-99-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1532-100-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe

pid	process
1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 900 set thread context of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 1900 set thread context of 976	1900	winlogon.exe	winlogon.exe
PID 976 set thread context of 1532	976	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exewinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304ed7d14effd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://59wv6s2a63342m2.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000072d2938974fb0d41a0d4479ceeb9a2d200000000020000000000106600000001000020000000436bf848e8c306d8365ac45cca5012853d0cdb1f724c8c87a0721c6268f09c85000000000e8000000002000020000000650e8825652487f2840798aa6841f8ecc8e8320fdd6ce630995122c2b4816fa4900000004b27fe27eb2e68ef8cfebd63f33bae6bc5955a8260a5f913ece989742a8bc5ead95e973f0c58a1a233df97a902a7bb518b55666b101ffd008d3f16ce139f1f3cfeb2466ed405b32eed7cb8810e997ebce50e718a733e3b226f74201f6f8beca054db80a2e16df6399e91f70549bb22d021e08aeb2710646f10d048a695751f3e31533d203a400bb717b0c9353bb2713a4000000062b33b17b94f53e999d0c65c6487f8000517858cc47873f73938fa5555510d4052601ff57a78879f3257ff66187c71d606bf8ee3701e27b6b116ea74a95a1e1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://90zj583i9q9u0pa.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://97mt71u3glwxb31.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://h3500v8v1h248wc.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFE966F1-6B41-11ED-965B-E20468906380} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://pjy33w3uh9k47ms.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://fn7060j5m7we738.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000072d2938974fb0d41a0d4479ceeb9a2d20000000002000000000010660000000100002000000068ef49b581094e47ba51611e1527490b4eadc2c7846ff1c723473ea797e97e37000000000e80000000020000200000000bffc18117556e12d596e72abad625feb7f4379bc3cbae451533b60b2bc6e4e120000000d1e9f50fbccd3a21e21fcdb9ff3eb19cca2a6fe19a44d7c0a3aa8f0a5601b0034000000054b8f4fceee21479647649e01116f20f3e70a44b55801b783d1a0be14aaecb44a3ab8cb28a92f92e80c1cacd4966dc3fc5b8f85b0e8b27e5a00e7148334cf022	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://4x9w7v8xa48lz3c.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375981654"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://bu149e5w37yx0qy.directorio-w.com"	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://bafllhn62ec6f28.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://ba88d6954je4l5v.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1532 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1532 winlogon.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exe

pid process

1152 iexplore.exe
1152 iexplore.exe
1152 iexplore.exe
1152 iexplore.exe
1152 iexplore.exe
1152 iexplore.exe
1152 iexplore.exe

pid	process
1532	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1532	winlogon.exe

pid	process
1152	iexplore.exe
1152	iexplore.exe
1152	iexplore.exe
1152	iexplore.exe
1152	iexplore.exe
1152	iexplore.exe
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 33 IoCs

Processes:

a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
976	winlogon.exe
1532	winlogon.exe
1152	iexplore.exe
1152	iexplore.exe
1792	IEXPLORE.EXE
1792	IEXPLORE.EXE
1152	iexplore.exe
1152	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1152	iexplore.exe
1152	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1152	iexplore.exe
1152	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
1152	iexplore.exe
1152	iexplore.exe
1792	IEXPLORE.EXE
1792	IEXPLORE.EXE
1152	iexplore.exe
1152	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
1152	iexplore.exe
1152	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1532	winlogon.exe
1532	winlogon.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exea206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 900 wrote to memory of 780	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	svchost.exe
PID 900 wrote to memory of 780	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	svchost.exe
PID 900 wrote to memory of 780	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	svchost.exe
PID 900 wrote to memory of 780	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	svchost.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 900 wrote to memory of 1648	900	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
PID 1648 wrote to memory of 1900	1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	winlogon.exe
PID 1648 wrote to memory of 1900	1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	winlogon.exe
PID 1648 wrote to memory of 1900	1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	winlogon.exe
PID 1648 wrote to memory of 1900	1648	a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe	winlogon.exe
PID 1900 wrote to memory of 1940	1900	winlogon.exe	svchost.exe
PID 1900 wrote to memory of 1940	1900	winlogon.exe	svchost.exe
PID 1900 wrote to memory of 1940	1900	winlogon.exe	svchost.exe
PID 1900 wrote to memory of 1940	1900	winlogon.exe	svchost.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 1900 wrote to memory of 976	1900	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 976 wrote to memory of 1532	976	winlogon.exe	winlogon.exe
PID 1152 wrote to memory of 1792	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1792	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1792	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1792	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1096	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1096	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1096	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1096	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1652	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1652	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1652	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 1652	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2208	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2208	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2208	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2208	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2780	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2780	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2780	1152	iexplore.exe	IEXPLORE.EXE
PID 1152 wrote to memory of 2780	1152	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
"C:\Users\Admin\AppData\Local\Temp\a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:780

C:\Users\Admin\AppData\Local\Temp\a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:1940

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:603146 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1096

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:668693 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275483 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:1192991 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9c094971a27ff86a263ae18cf5a0ff14

SHA1
368624fab92930f3edd9818b82341a152e72a162

SHA256
078a8257a7f0fe4fd6eb28f408e8ac24b0b018aaa023b37b1db23005ce91bd63

SHA512
236c9a1af251eb8175c25718f724fb564c6dd3aa48330641c0fa2bc2885c29d40f8cc504d1e68e5d9b4983760497b02aba396675deeaddeefce2214a3e6a82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
bf2e7be3084ff4a3dd2414c954266132

SHA1
b407a494cd28b982e607f85ae1000e0b5d29d119

SHA256
42291d85698183c0df519ff0e74a50d04807cb3a9c2753d8fb837ff76f212962

SHA512
36579179442777636f7cfdfb909770499a6f86753c4fc80c403352d214582d6defed003fe19bf54973e77de515c14b632d0e494bf6b30135dde060804418be3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
e2d1277dde67909496116488b2656572

SHA1
627e6efc9f6dd6dbf16576402e8ee25102bb23b1

SHA256
5d5db82b5372b891947da1bfef7dccee7f97cf90a0f263c45ee8b086c13fc26d

SHA512
74638eca50ac2baf6edc599b634229f0a18371f2a30f99389a076a14a3ca561044db1f80fef9af58ad79bf55b3a55c2bd37ec76ff7b451d69844ecc453b6cb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
abfd88821addd9515cb0c1a7e7a378fc

SHA1
fb03f88274e508c1bbf18ad42c458de80d8192f0

SHA256
cdafb468c41c3ce46a06b74adf68c7c1904c2a97624e1490b4b94cc4e2393694

SHA512
6d06e903a8fe0b0b74f5db0e767852d0056a0e8bd64308acfdf7a30bc6ae0d62059d7965d3eb80f757444608f8be6c3719165abb4881c26ea66c313ac83ca2da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
f83007cdedaa2134d3bb36e1b923ad4b

SHA1
47fa76bda376f8ceff630a439816950c8c5b38f3

SHA256
75aa5aca6503a9682bf399c455a55874279b8b415f3eea0ef49dbdb89fa58bfc

SHA512
7dc7cb2e97e642dd190815e711091e9b7d139ce926ded9aa3b6f84b6fb2b85e7045d24a3ba729430706bc8914357e692cf4602a66eb25b57f300fba52199435e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
d319f6c2d9e7a8e3b885bdd2cc8df39e

SHA1
fc33479391cc00c5938bfbd65d212e6e47ab19d1

SHA256
acd3ae4fb3768a30fb6d85b4aadda08f33732f2102e2c39fb75db4247d1d9cd5

SHA512
7f508a5b05afb400ac3fa4517b2d515cc3382cf9d55ac3bbe2d775430a4c2b7c0be1b50d51a75b8a38447ec9e1dc044e3c42839a4ea2f45bcc0be7b5240a9dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb99791320080b11d923dff74f379b6f

SHA1
0bdbf07372d5e065d109fee3c16c89f636ea1101

SHA256
ec31c797a3c9eeff8956c72645e7f7ab1621f87f034c4c60eabd6f4378962687

SHA512
ddcb9c77649c39f8e752e383bc6876b61c4e07d5470cd8009cdaae67d26b519801b1f57a3070b421140646714642672c65d071c045d202fa7fb54133ee726745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce7438aaa8adcaf6688f283904094091

SHA1
ec99045c8f8d2ace92ee489a8a982222a5caaaed

SHA256
5c41843f3e34c7ce2b496a0056a90bfdaaeaec6c97fe11adfa73aafbc74a38f8

SHA512
31f1121ff8212266d63bf7869d3999faa96dc6173a6c68a5be0cbef3ec5f4056ca82ae86c3b2c463dfba1c88515f60df31bc08ddcf697ea48d39c985b5960dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6715d6257927ca2ab2defe150d764bce

SHA1
5f55bd3f5941585b7a5c4a04e30652b7f6582d72

SHA256
f6192703f9b1e2381f8f9f7e055c53fd3f5d2c2a703cc33a2e31df2b286e9dc9

SHA512
fcf016c98aa268e3f9452aa6beb4d00f5f591f33c8898ee1268f0c5602cd5619220f947c01352f0e518b9f546de69aefd1a761ff6002d2a06faa15b73cf46306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6410cb2eb2d8afc212b23886245746b1

SHA1
d751da27274a5518b5bb9664efcd0c474147c961

SHA256
6ebca0d6a1ded005b2ddf7626ff24c144421e0193fec0d51346436ea4e9b7bde

SHA512
335ee1991bf7605573466574881683a9acef854c51e8b6c9095f22949a48b34ed9781f763ce6549997b446875c8b7ba2adb5af16a65bf36de7fda9b745bc5fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
958bc6498eba1cd84f0074bfb14a16b8

SHA1
00ab5d4c32614ce27f627e1c622c2ceb3ee462b5

SHA256
6c8c2b2290574400da30d9047a736ea8c6a4812054e0c38d750953b823d7289e

SHA512
08e510a2f5b4cc9c6091bb50a44e9646a3ede6bd5fca598235d27140fd79fa6d78bfb1acf05f444f3b9786f9fd4db0b8a8065089a09a825f2213b3412a5005c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a7eb9769de5a6c4c13f4db75c2bce8a

SHA1
23f90ccb34e17cd590a116e99e0c14470d5a4fe9

SHA256
58179b28e6e3b57ed10bab53ed4abaf3f9533b989c08c5e28bfc33a4aefd5ac5

SHA512
d06f8fdd5c44dbce5e46f1f3644e805c6c6b6e539f0689b0f50ecf159487e2410b5b6f15fad81cd8c6017b33b6045b833ccef2d0192dc41367ba1514e2ecf349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b763ee99b13cba3966829da35169ea4

SHA1
41abb88d6557b5174a303ab16769a579d8fd3faa

SHA256
848f2cf02b19a2d758a006116b1c1a262e5fdb4e5b23a7c2f47f620b97fedb08

SHA512
bc3f0dc14e845b1faf6950a86920b2825f55aee3fe65b8cdf91ed2a4127ae4085d211500047d1709a64bc928d6e638b5e9f42d85e9e7b9cea96b4b2473332369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
19f25b9e1839290961363ada9487455e

SHA1
6b655de5167b391843f1eac60281cc44f35a99d9

SHA256
cf604b5059e984bd4620cde3b44801ac2fa526d2d00ef8862ba043598bd92e25

SHA512
60c1c3f44db81b84eb78264cb781ca0d2b7c172c94b3bea3599f8a55ea813b832fd0c3dfa4e2167013ade02511a56f547c9a61b87d7f939446a2a14b9bfc9aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
73d370f6ee8734217f288b4a10c51c31

SHA1
4637deaa812ab0975493a03ae48a4958716ab466

SHA256
9b8fb09c6aba94ef19ebdf67e1a8c0d0219624051136b9a1af9211b5a92ca88d

SHA512
78195b0c8ffe5dbc83508f79a175cbc1c7074cb8f47442d2864e48a77b1d96f4cd9fda9a8dd3d67783ab5fbb6d7619844ba36f0aaae653c16d4660600f5321e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c638d14f03bca2046b7e9c99163db6a9

SHA1
75f60698b0aadaac6691bce8ba13ff71eec19d82

SHA256
b22560751a7923688e0abf25704df02c6cb6c9d86d92ff0a3adc640b13c4ab88

SHA512
3c33ca60e5b13e562aeba710db888f9f1d89bf600003b72daf400283ec636a8cb0457037c7c7cc2bddd6bb1212adccc6d5192aa5914c8d9b10b58daef0949506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\36CZASPA\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AUHR9VM8.txt

Filesize
601B

MD5
0aee96b63aba69de1605ce5dfed82753

SHA1
5601213b6a722e2661ff147d2f1631f60c9e1026

SHA256
38455e876f8fc7c57da720fa5bd84fa4463a1d9fa9f75a1c2b0bbb47e185abe8

SHA512
1b483a230be56627f8c0f339e73345bc12021551155167bc5ac6de9412ab1de57e5ff3c1a6c376d750bffc8a6f40d7a1a4a08afa7738b496cd8af8550d0e4cf2

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
461KB

MD5
a24a3b0b05139f148ccc7ca0af3483c1

SHA1
367089a4d30d9015fc17a62e3f03054be51dc8b2

SHA256
a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

SHA512
abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
461KB

MD5
a24a3b0b05139f148ccc7ca0af3483c1

SHA1
367089a4d30d9015fc17a62e3f03054be51dc8b2

SHA256
a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

SHA512
abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
461KB

MD5
a24a3b0b05139f148ccc7ca0af3483c1

SHA1
367089a4d30d9015fc17a62e3f03054be51dc8b2

SHA256
a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

SHA512
abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
461KB

MD5
a24a3b0b05139f148ccc7ca0af3483c1

SHA1
367089a4d30d9015fc17a62e3f03054be51dc8b2

SHA256
a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

SHA512
abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
461KB

MD5
a24a3b0b05139f148ccc7ca0af3483c1

SHA1
367089a4d30d9015fc17a62e3f03054be51dc8b2

SHA256
a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

SHA512
abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
461KB

MD5
a24a3b0b05139f148ccc7ca0af3483c1

SHA1
367089a4d30d9015fc17a62e3f03054be51dc8b2

SHA256
a206a328558e6bf5f770ce48e0b379d2fa0a79846de66ba9a8b864b02d75f187

SHA512
abab10cb74a1e529c30f5356d325862a493606df7d688ad7f4f6db926747673037dfd60ca8ae8de1bec93ecbc48a8405f1664a12bd707cd772a00f9c6bc6afd8

Download Submit
memory/780-54-0x0000000000000000-mapping.dmp

Download
memory/976-99-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/976-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/976-80-0x000000000041ABB0-mapping.dmp

Download
memory/1532-98-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-94-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-90-0x0000000000441740-mapping.dmp

Download
memory/1532-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-123-0x0000000003A90000-0x0000000004AF2000-memory.dmp

Filesize
16.4MB

Download
memory/1532-100-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1648-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-67-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-66-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1648-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-60-0x000000000041ABB0-mapping.dmp

Download
memory/1648-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1648-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1900-70-0x0000000000000000-mapping.dmp

Download
memory/1940-73-0x0000000000000000-mapping.dmp

Download