8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
Size

1.4MB
MD5

baf24ad6e9cdf465368546b37bec7feb
SHA1

74452619896ebd654bb1c2c501de9a0bf8266056
SHA256

8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f
SHA512

5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176
SSDEEP

3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1304 winlogon.exe
1116 winlogon.exe
1388 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1304	winlogon.exe
1116	winlogon.exe
1388	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unzip.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpinst.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdetect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atupdater.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bd_professional.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avupgsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pev.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpinst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcciomon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmias.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumphive.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aplica32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\localnet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdoc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfweng3.02d30.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VACFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2k_76_1436.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhlpp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/968-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/968-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/968-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/968-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/968-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/968-72-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1116-87-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1388-88-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1388-92-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1388-93-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1388-97-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1116-98-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1388-99-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe

pid	process
968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1812 set thread context of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1304 set thread context of 1116	1304	winlogon.exe	winlogon.exe
PID 1116 set thread context of 1388	1116	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

Processes:

winlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://no5g44n6g85p2d8.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://j5w5hlt1144ph8a.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://0dj29135200ey95.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://tez8o1vqc3webj9.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08f78c150ffd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007461223cfb8a3a4281d9fdeffef47eae000000000200000000001066000000010000200000007ec3c0d61ccdc109de8820bea51561379c8b8b7712262b3be6d600371f4fc691000000000e80000000020000200000004a94ee111d8b8bd61dc494e7b978b6ea0a015942bdc81e5ae4156a6613f10c89200000006031614ed3d11d756766d57b162f7c904482a5a61a4d72cb9a85a45080733bcc4000000063e17f0fa0d70abdab5bcc44a802f7dc5886014e1e0824ce285a623ba6010becc18bf1b2b3a4bf4ecb88572f156bdbb6361109ba0b8a1bb40fda6496bc6aa819	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAFEDED1-6B43-11ED-9351-5A21EB137514} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375982484"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://kuk20ehcxro4h19.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://63exd33347489vs.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007461223cfb8a3a4281d9fdeffef47eae0000000002000000000010660000000100002000000037247b80f4a0bfba67b2d8786cffa1590a219c751ae97522ed05ca804058ed93000000000e80000000020000200000009d62794ccb6a22b4de30a3bd0be45ada763fb8a240ffd1519fd276caa593d077900000002c3f41db74a76938a784c846e12e48a4cf6b5ee5cbf359dbd7c5954dfdc6e3ec2bfeeb248e76cf5f56d17cb6a2a13cae2714354fbfcc36e82fa6815d66fb6ec9939f1e9cbd71f07f7cf05f5ef739b7b93fa55b0d9c0ebe06deaf3a8c57717bfebb791c903b7e70a418ccad0273fb6cb51b2dc1c71a63009d25df055af43d487c0bae21a2698333ff7d811bc0c9505a2940000000d370fee07181d82d8ff7c9e46039216e788a0c3b1967680c63bb41747b0d20e3cd532ea4cc06b4de80f8e6a5f3f6d05e45b5f0aabd1bb7c730aa183ac9ff027b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://xrjsi17794mde89.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://zt262a2vo4adm9d.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://582rr9x3jk7d6b7.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://57q29544ef7i4tt.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1388 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1388 winlogon.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

616 iexplore.exe
616 iexplore.exe
616 iexplore.exe
616 iexplore.exe

pid	process
1388	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1388	winlogon.exe

pid	process
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
1116	winlogon.exe
1388	winlogon.exe
616	iexplore.exe
616	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
616	iexplore.exe
616	iexplore.exe
828	IEXPLORE.EXE
828	IEXPLORE.EXE
616	iexplore.exe
616	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
616	iexplore.exe
616	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
1388	winlogon.exe
1388	winlogon.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1812 wrote to memory of 1728	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	svchost.exe
PID 1812 wrote to memory of 1728	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	svchost.exe
PID 1812 wrote to memory of 1728	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	svchost.exe
PID 1812 wrote to memory of 1728	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	svchost.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 1812 wrote to memory of 968	1812	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
PID 968 wrote to memory of 1304	968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	winlogon.exe
PID 968 wrote to memory of 1304	968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	winlogon.exe
PID 968 wrote to memory of 1304	968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	winlogon.exe
PID 968 wrote to memory of 1304	968	8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe	winlogon.exe
PID 1304 wrote to memory of 1248	1304	winlogon.exe	svchost.exe
PID 1304 wrote to memory of 1248	1304	winlogon.exe	svchost.exe
PID 1304 wrote to memory of 1248	1304	winlogon.exe	svchost.exe
PID 1304 wrote to memory of 1248	1304	winlogon.exe	svchost.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1304 wrote to memory of 1116	1304	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 1116 wrote to memory of 1388	1116	winlogon.exe	winlogon.exe
PID 616 wrote to memory of 1632	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 1632	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 1632	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 1632	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 828	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 828	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 828	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 828	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2100	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2100	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2100	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2100	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2376	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2376	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2376	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 2376	616	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
"C:\Users\Admin\AppData\Local\Temp\8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1388

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:1248

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:406541 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:828

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:865291 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275477 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9c094971a27ff86a263ae18cf5a0ff14

SHA1
368624fab92930f3edd9818b82341a152e72a162

SHA256
078a8257a7f0fe4fd6eb28f408e8ac24b0b018aaa023b37b1db23005ce91bd63

SHA512
236c9a1af251eb8175c25718f724fb564c6dd3aa48330641c0fa2bc2885c29d40f8cc504d1e68e5d9b4983760497b02aba396675deeaddeefce2214a3e6a82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
bf2e7be3084ff4a3dd2414c954266132

SHA1
b407a494cd28b982e607f85ae1000e0b5d29d119

SHA256
42291d85698183c0df519ff0e74a50d04807cb3a9c2753d8fb837ff76f212962

SHA512
36579179442777636f7cfdfb909770499a6f86753c4fc80c403352d214582d6defed003fe19bf54973e77de515c14b632d0e494bf6b30135dde060804418be3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
e2d1277dde67909496116488b2656572

SHA1
627e6efc9f6dd6dbf16576402e8ee25102bb23b1

SHA256
5d5db82b5372b891947da1bfef7dccee7f97cf90a0f263c45ee8b086c13fc26d

SHA512
74638eca50ac2baf6edc599b634229f0a18371f2a30f99389a076a14a3ca561044db1f80fef9af58ad79bf55b3a55c2bd37ec76ff7b451d69844ecc453b6cb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
d16dafc4ea6344a8bd79d6b9b93afc35

SHA1
6d8da7ddfc3fab74c7e76d2912e0b4df45079e21

SHA256
9aa5670ffd17c598e83c29d7d6e6437d1fd84657bde9b743cfd72af7e8d82b2e

SHA512
bcd16a5bc781dc43f37f8db67e79685c16dfc6e0e1f9090fa3ce2974cbf609088cb0be77f80b52bbaa190d69a61019906846c912805ab8ea90a686b228160afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
5d8534fa0a04368cdd9680cdd9b24f62

SHA1
f9ae18bbc573330a7ed6a0fc6d71ace88f64063a

SHA256
ff23800b0a0413eb5e0b2d0f55a2ca1a1010a5daafd43f89975b4406ecd1b6a0

SHA512
cc74ba80baf4f0c9f2baf84a2ffe9fdcf39ea0f8e8e287cd20e4b279f67c576e51a887951c5e9b2583585df99574902aa2cf2e8a648f8e349abfc4b8351ee9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
06d0a4fc9481382d7330ce8a4e73f07a

SHA1
1768270f953de83fa47a8ba9c2bede89f9482183

SHA256
539cd914000c6b039b9470b17135a860fbab283117116aae08f6187f891ff9e7

SHA512
4a62e6a6cf90a4671fcf348ff9c8828bc548246b0637da078e2c74cd551248fb1017b47cc17ab0cd7956b4ef503311e668ff8be7c4e43fa32639145a62a3689b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe33e11684916f9d320a3a3a3bf42823

SHA1
da320696028fd9af9e9288370f3c6d5263425195

SHA256
3ca19cbfaf38f5faf5a556b245b59ed54aa8ef359a268ce4547f2cf6e3ced424

SHA512
f8809df3f1a378cddc19188276e82f911066ab58fa4f902de8f4e91c98e1c10d8e875c6a1262fe683a27767b87fce2921b181dfde6a73edabac21102c79d3f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
906a73eb2468f4c04096ac0eb103cf9c

SHA1
7f253d60cc6ebb9edb3899cbb591639c9e605b55

SHA256
cb37f4d87c147927b57d0c3d81f83874db6affaa7d2b98b11f67c80cef911671

SHA512
c10faa70451e963904954fb0ec60341016d39e08b4386d6d0eaa64e6ec909f18b2ba6a8dd269bb1a802b4e43c79f73da9c5565dd2993afa989e5a7dda84c7b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f0f86aec7db3cbc7a7bcbe346008d2c

SHA1
b693bc51ca665fbe20985648fcf766f86bb17fb4

SHA256
121b07a7085294b7131e556f678838ca586125fb8a8c3010734257c5a9e5537e

SHA512
1ebd3a97e9205912f7a6bed8e9c6b67bd62b91f39e8dd8f10db908b58e1b1b4c85163b7888d9706dd0a273a6943f38e433a40629776fa9af4fe9ec609b027689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b6521f0397abdcb7d9512cac4ee0a3

SHA1
2cb812db11af54322fd2b0ba4418c40a94e4f20b

SHA256
c0d70654975d40ddd78f4b862d8685fc57419078ecaf516ccbc674c9b1b9740d

SHA512
5315292ac9ffbcf7ee7fc0c8720c74ef311a6be53e6b54fba968828fc3459b53525873bcc7a74c76844247cf8bd0f70f4c66ec3aa9f0afc07526bf63832ce0a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9af0ed03bd6b6de7a65e3c44c8217e1

SHA1
609985b5065decd4578d7fada080e074bc4f4465

SHA256
7d245ecf601cc93876583a2ffbadf339b73006ae686f9b34cfd62b6429821945

SHA512
ff0162bc835d2a510fc1ca5375fb71b456eb6fe49fad50b44d3e28fa5c569f150265dbe9113e7a3815abff0afa854741735468051500da98b17ee8b0f2a08f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
539872ee1b1fbf2e90b84153449140b4

SHA1
2feb5e1ceb6e6fd3348db1a3006632ec960e8bc0

SHA256
0ae6ecf361f4bb4ade26fc71687aee8e6f5f6c83052c7bbb871058c9f85cc235

SHA512
35ac8bac0b61166d98908ad294c9c28411675e7752dc4d28ed9f1e751f58f8342cdfac032e959d23509b4f8e34da9a80ec64635a37ca6d26f4a4cdbc9d715ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cc6eee1020f91c3b3d1935adc0f61df

SHA1
8526e62723a3d2d5b0ab443c6cce406adfda8560

SHA256
995323d5bc4455125444b24595f3f7c59cfadf557fd50800a841784ea842c237

SHA512
b842a3e01ded0004467883305400cf95311662b5cba725b1e541a29cebf7b9f2d9da864541b89d0879e767d3d87baa1fbb53cb915828e710c624db5d8810af71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7faee234b104e6eddc4e2a1ac1866f95

SHA1
858b96472222d7c97a53f609051857366cc708fe

SHA256
b2f5d3f1b2b732fd6f2ff995f059686b10ba30a9a29efae9b89d467da149d6b4

SHA512
c063c35f7b3e3cf94a7875170d478caf103c422d1e173b259133fe5447bf820f4707edd0483edeb8bf50b826106ff97c862ee3d13356112ed27fb6034064f7fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b18e98563d61a5de5a94788b59cc3b8d

SHA1
96fff597a053a7acc9a2b06ebd1316bd1e85e9c3

SHA256
6ae08a8ce7471778fef8536b619f73058cf79316622a7b5ff18c9f65f4f23af6

SHA512
fada4952f0ebcdf1a7809052afc235adf3f5d8bb372e33cd31a9258a1b1fdafa8eeed5913050813350368c04e4d30ab6d05882b3e26b17a607dc523ba74988ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
5daac98a638863e4eff177a985e4a473

SHA1
68fb3b642989b5da474df2fe8b54b07b1a458525

SHA256
b54f4329e8b74918e19cd7590ab44e8344babd914e4a35e453849bb846039337

SHA512
803a2d02621bc68f3c65a3709341914935f61f4bc16fcac012c029e2e20b26e81e3a4fbe433dd8316dd7a63d26eb3847011ab8f9ef78e3c56b02bd32d6a15756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
73ba76ecd7e2ae933e2677938a6c744c

SHA1
8ec2894c9429d520b317dd23323d30acc8b09d83

SHA256
d1a6ce7a15aee96f3c361960d8d74dd7b1f7c21150a5041375989f44500614fd

SHA512
8d87caf3986ee73cd90c5cfe7e8d4b43cbd4fa3957c32c23b058522676526ffb4fd890717988287900eec196385532167ab6d2db174c3ab8d3cf623f9270a026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
39423ca1d3e7d982028f4a60cca2afa6

SHA1
259fe5b85b670170f60b8685e7d7e229eb7f3be0

SHA256
74f275329eca81cf9d17f706fb77177db1ed77dd5395cf496404a723be527906

SHA512
0f32162508de338b3958bebd21125417bd75f0df441b31b49da47abd81be9594e09864a36a96d483237916c57af8c2745a735e7a5f74ff81806b03f550e4cf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\38EGOFIY\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1C1D2EF2.txt

Filesize
601B

MD5
a040ac0ad5b1fa1e27a686bf17b004f0

SHA1
e6d5b27755cc91e8062bb6cfcc5a262ff282a3a4

SHA256
59e461b776b61647d808eb1d39edb062062d251a4a454e6ad0330af75628f168

SHA512
b16c3b9528a6c385419b0caeee50d929e88593d9c2819d9f64edcec4d51a7ac0016b97c96b83a918d13db3adb8e515f2ce607357f0d7adf21a17cf3290882424

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HLD0712G.txt

Filesize
110B

MD5
b25d8d660d6d70b43330de33678dfe1a

SHA1
27b04c294fa6d1bde4619fde4ccd5aef096ed795

SHA256
af9bded2ca2b01ac0c6d372c39b0f599a0c407e3b9814e77e7c98d63efb09f22

SHA512
59f2d35d2c92057aafa511e8367e08b0497ebc080e1d5ce49dd754610882a61483fcabc34f32c75db074dd75c26b28f46ab88ed1c38b0b92bb00fcecae57a1f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L1LSHXWT.txt

Filesize
136B

MD5
9dc4dfd2f368819da747937d65062037

SHA1
e18de44f1b4f0622735d5ee11413794f9017d71b

SHA256
3d0ef7f1fab132bb7b562b9c513adcfe316473c2824be0a8087f6ba6634b722b

SHA512
fed1cb8948fb9a5bbaf4280aadd5fed20994f472d1614100db4831708800b377bbc8b11c1e03c32be4ec0e61bcb293b6a8cb1836173feddb8f210451e7fdd197

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
baf24ad6e9cdf465368546b37bec7feb

SHA1
74452619896ebd654bb1c2c501de9a0bf8266056

SHA256
8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

SHA512
5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
baf24ad6e9cdf465368546b37bec7feb

SHA1
74452619896ebd654bb1c2c501de9a0bf8266056

SHA256
8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

SHA512
5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
baf24ad6e9cdf465368546b37bec7feb

SHA1
74452619896ebd654bb1c2c501de9a0bf8266056

SHA256
8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

SHA512
5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
baf24ad6e9cdf465368546b37bec7feb

SHA1
74452619896ebd654bb1c2c501de9a0bf8266056

SHA256
8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

SHA512
5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
baf24ad6e9cdf465368546b37bec7feb

SHA1
74452619896ebd654bb1c2c501de9a0bf8266056

SHA256
8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

SHA512
5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
baf24ad6e9cdf465368546b37bec7feb

SHA1
74452619896ebd654bb1c2c501de9a0bf8266056

SHA256
8e05202bc36b4823c49063de29834b15f8cb6d267496bff68c151c625324224f

SHA512
5b9403dbe0e784f9ed081d94131127b9a9e265c99ab072012f9f8bf8f32382105347f8b1d3ca2d6767122c541d6c7cc6601b04782c6331862722c5046cdc8176

Download Submit
memory/968-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/968-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/968-66-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/968-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/968-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/968-60-0x000000000041ABB0-mapping.dmp

Download
memory/968-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/968-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1116-79-0x000000000041ABB0-mapping.dmp

Download
memory/1116-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1116-98-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1248-71-0x0000000000000000-mapping.dmp

Download
memory/1304-69-0x0000000000000000-mapping.dmp

Download
memory/1388-89-0x0000000000441740-mapping.dmp

Download
memory/1388-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1388-99-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1388-92-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1388-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1388-125-0x0000000003F30000-0x0000000004F92000-memory.dmp

Filesize
16.4MB

Download
memory/1388-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1728-54-0x0000000000000000-mapping.dmp

Download