28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

Analysis

max time kernel
175s
max time network
192s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
Size

1.6MB
MD5

0113e41018d832aba3aaabe664ac4775
SHA1

dfeedb9da14800ebedb5bf051a8387d35f48986c
SHA256

28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581
SHA512

e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a
SSDEEP

3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1064 winlogon.exe
2040 winlogon.exe
1632 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1064	winlogon.exe
2040	winlogon.exe
1632	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icssuppnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwcl9.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iface.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atguard.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netscanpro.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exit.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avshadow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95_o.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\css1631.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2servic.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netcfg.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin97.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/952-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/952-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/952-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/952-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/952-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/952-67-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/952-79-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2040-87-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2040-89-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1632-90-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1632-94-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1632-95-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1632-99-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1632-100-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe

pid	process
952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1676 set thread context of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1064 set thread context of 2040	1064	winlogon.exe	winlogon.exe
PID 2040 set thread context of 1632	2040	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 63 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEwinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://3xr717dko30b394.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2EE78C1-6B4E-11ED-9E5E-6A950B37D0A0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5096b4895bffd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://77h62e6u1jnnev3.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://1i385w7fc19c93i.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://kht28xg128bc89y.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://8s9h4242g6pn11e.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://2v7t28s2935b0vi.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000007fa8bb11b04ed2940844b910f645c7fe29348a0930bb11ef62efae5fd7bd438a000000000e8000000002000020000000a88b7dc428e7705d44e253c0aa7269cfc15c8759d4681185dfe6f0c893e1d87790000000cccb8fb3c7fffabb5452107c60c35db3c1962249919bf7e0783607e0efffa4c290b71eacebeb20d46fde6cf64ffb7eb8fb1e75a1df7a172855ba3a1f6ff4e6bdf0ccc107b2d0e5a9336084c4b743f0f750f6957deb8e2efdf0331524fef1caee70b96ecd4dd63d512a818ea3eeadb1b0b0957c17ba6b90d276515d71fbf1de289b5e92e2f600c2831d8ecd4f3daace67400000003d0d89d55aa7552cba851f2abfba2e283e2db0c1986b964f3a4695210feb64ffd8b128fa06b4dee42d3f63588ee8e4c308c7b34459cf1348efa933eae48bf2ab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375987089"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://045y1cg946n8w80.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000000f5db9f6d2af9c5dfc44bac97cb5b6a77661f1a0c8c00a2bcc5cd8a868bb8bde000000000e8000000002000020000000d8e3fc4c22e20ea2ee53e9ebd69c37f19ee36062c98e16aaf828644ea1ae44b2200000008fbe53884e36b0b1c95779d6f80f9a340b7ebed91aafe7d4826e9b5101f0697b400000009aae69d408317c89fb7d60b89b7aa24c55d8b129cca64550f1c92f436eda599286f04a92f0e4751ea388c8cba6e3ceba5dce078bcb07a0e6405a8ceefafe4ea1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://79u2091sxo6411h.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://99b3yi30ect2itb.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://896sqs89jhvbob0.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1632 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1632 winlogon.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exe

pid process

1876 iexplore.exe
1876 iexplore.exe
1876 iexplore.exe
1876 iexplore.exe
1876 iexplore.exe

pid	process
1632	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1632	winlogon.exe

pid	process
1876	iexplore.exe
1876	iexplore.exe
1876	iexplore.exe
1876	iexplore.exe
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
2040	winlogon.exe
1632	winlogon.exe
1876	iexplore.exe
1876	iexplore.exe
672	IEXPLORE.EXE
672	IEXPLORE.EXE
1876	iexplore.exe
1876	iexplore.exe
328	IEXPLORE.EXE
328	IEXPLORE.EXE
1876	iexplore.exe
1876	iexplore.exe
1592	IEXPLORE.EXE
1592	IEXPLORE.EXE
1876	iexplore.exe
1876	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
1876	iexplore.exe
1876	iexplore.exe
672	IEXPLORE.EXE
672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1676 wrote to memory of 1952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	svchost.exe
PID 1676 wrote to memory of 1952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	svchost.exe
PID 1676 wrote to memory of 1952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	svchost.exe
PID 1676 wrote to memory of 1952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	svchost.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 1676 wrote to memory of 952	1676	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
PID 952 wrote to memory of 1064	952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	winlogon.exe
PID 952 wrote to memory of 1064	952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	winlogon.exe
PID 952 wrote to memory of 1064	952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	winlogon.exe
PID 952 wrote to memory of 1064	952	28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe	winlogon.exe
PID 1064 wrote to memory of 268	1064	winlogon.exe	svchost.exe
PID 1064 wrote to memory of 268	1064	winlogon.exe	svchost.exe
PID 1064 wrote to memory of 268	1064	winlogon.exe	svchost.exe
PID 1064 wrote to memory of 268	1064	winlogon.exe	svchost.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 1064 wrote to memory of 2040	1064	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 2040 wrote to memory of 1632	2040	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 672	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 672	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 672	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 672	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 328	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 328	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 328	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 328	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 1592	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 1592	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 1592	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 1592	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 2244	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 2244	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 2244	1876	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 2244	1876	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
"C:\Users\Admin\AppData\Local\Temp\28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:268

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1632

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:672

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:865290 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:328

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275472 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:406547 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
9c094971a27ff86a263ae18cf5a0ff14

SHA1
368624fab92930f3edd9818b82341a152e72a162

SHA256
078a8257a7f0fe4fd6eb28f408e8ac24b0b018aaa023b37b1db23005ce91bd63

SHA512
236c9a1af251eb8175c25718f724fb564c6dd3aa48330641c0fa2bc2885c29d40f8cc504d1e68e5d9b4983760497b02aba396675deeaddeefce2214a3e6a82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
Filesize
1KB

MD5
bf2e7be3084ff4a3dd2414c954266132

SHA1
b407a494cd28b982e607f85ae1000e0b5d29d119

SHA256
42291d85698183c0df519ff0e74a50d04807cb3a9c2753d8fb837ff76f212962

SHA512
36579179442777636f7cfdfb909770499a6f86753c4fc80c403352d214582d6defed003fe19bf54973e77de515c14b632d0e494bf6b30135dde060804418be3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
Filesize
1KB

MD5
0af1f4e1078cd440bff412de128fc00e

SHA1
ca95a38791d9b303d28077d2a643e5476af8e8b5

SHA256
9a5b371f05746a515922dc9ff0e1de22931fc507f6b9eab438243b0fc099c670

SHA512
d926d0ae8ac72d2caae6cfc49d5259f71a197388e9e13a7bc4fdfcf53372c041c712befcc1de8bcac4be3cf3780037d3c693858296f048a62066dcd379b60b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
8d2973a451cf67f00fdb09240e273704

SHA1
125736d70ddc0a5f7839fe44ea5decce836e29a0

SHA256
029a740080f25f0a6fc18623b309ba5b355dd45d3017112a32f06193664cae76

SHA512
31da2dbc4053921059975d2a5411f099c7563eb4594bc4dc2c0cdf8e196da8c05280da22a53b7044cf597f7eb09d098a2a2ee1b5996480a898c1bbfb1d70a063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize
402B

MD5
a2eacbb1ecff6a04c8a333b34d1ac907

SHA1
a5c0ceae7a732645421faf40745a43402f86cb94

SHA256
a842a07ec888f733b0d055a45134ab27959b6e462920c3291a9eb4b5a9ffb95d

SHA512
afe4b75110a2ea1c9db2bb2799d43af2f4969d27f87da460408d9ff071e4ad178ef28065948fd620c2f089a11fff5be98da1add4f8def7fa1a70421a525e2418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
Filesize
466B

MD5
8119e8bf5176037967dfbd7e27d42887

SHA1
25bf3fd1262f614aa643f52239d35a34bb6774e0

SHA256
56a60b9dd10c9485246d6db9900218f37591bc8a5bc944666e79ce4ad0e8a691

SHA512
8e424e1f8b13f8865f981d7eb21c3c033ccdc53628a873feee970ea8f18d60fab3a947c1d4e2b22918946a9608ab198db60fcac37fc1d111ddc2094a2d5bbfdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a5383b6b7d29620dbc18cb658488b245

SHA1
ccd87626171a6c842f468e1ad3dea91792ca5682

SHA256
6b011596dc181bc567700623c8c28ed6e158c270f0473b22e75a35beaec8d8cc

SHA512
9eeec2bd8acd317c3bcf57d845739a14838b49939e7eee9da51eeb151e9d9a727cab089610935fc64abd0fa0a35e23ca2216e0cf70b5cbaad823a266aca1ce79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
30aab9e069205bb70904fdbbc40a3fe4

SHA1
7738481b37ddd8c94cd2db33f1f33747f09e1f2e

SHA256
9ac115885551b49d8aad6f9ac37bc54e5bef23d0d9ec44e7ce392449f245a64a

SHA512
ce5eaf0d0f658c1e043e275c9aaf2884991dd064775319a51bf0270607fa5656d5f9123cb2e11ddc9fa714fe758142d4814951261ed4f33f4cd3d3030d1ac726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8b1e57d0e00ad45bebafaff05866b0c2

SHA1
2c005ff28a4b743cf5362482077ac776684677b7

SHA256
df09db7ffca94859ec91ece1ca9aaf427cef9d511982817e471f6f1e5d36f423

SHA512
68b09d5237687432b8173a732de6d4b8389af73fa402a81d333c2d4f2f70a48e18e6933cd802d39926ac697508f718d78d4e74b3bff6d5a588e96c0f6e9afc5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
709ed0960e22e53d200232109247ebd5

SHA1
562fa778f5ed556d635eadc147a4a346ad497f64

SHA256
274549c970a4197c79c2b784f9cb99a7b00ae2bbd0a6b495f87975a22cbf14e8

SHA512
1a27cc0866af8dec92b7a520a6322afe0fc65554de6b464ec5a266757e010d74515e0c552185491a53e35b9f905fc07cf8595483a9192d265e457c9bf8464712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
aca22e3a851f3b477ff9808678ee9ac0

SHA1
a2f84190afe5a57b222c2b69d7e54ef951445c2f

SHA256
ace030f56ed52d6c148966dd003c8869622348933ec26545cd0eb2875e6610b8

SHA512
d26f3f22b9e32d8a65cf64051f599b6c892b2d211ab21e83d70fd4c107c1d5e3d08f5061d6f95a5823a0580d8bbf8f7a3eff2bdf00ec0ff10534cebd3d16f4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
dad29c87b3fe21d9a9110bbabd192950

SHA1
a936df1bb14c12506c80deef954ce6712017d47c

SHA256
034795c303fa10c665cbc871c0703b931113545377db12aa40e185cb2d6dac65

SHA512
725ce85a0f50c8b6a49bc456dade6447f2350a420ab3530534bde8d0c3ee8733e61ae8a5d38dcdb269ec94ca46387e96b9f1208a3ba14e2db9c7ef5821109ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
606ebb6ec7cf6f0842fa924e8be4514c

SHA1
c26f923a7991127df8a4a29cf34ed8a4c47ca84c

SHA256
429fe84fa7abc75ceccc7efa2eb650df05cb1dd70963da6ff0af848251146ac9

SHA512
d6afb2afac6e611f360c3190321e95b15677b8b5673225e3824a6aaa96b6ca733e21987d93912c890d0eacbdc36c28cc96a139981e188b8342b67670c107c3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
12e24f20034d238129312d9bd7a291a3

SHA1
e8ba25180c5e69168ea68392dee30826b1bc8f70

SHA256
8982fab853019b5a9940c1ea9fe06db9fa0609bd12089fb88849987ffe6abeda

SHA512
c907bddaf52cc226bc9c8b25ef20f064d66665a485684d172898ce498aa99773007df68d0f172b24c54321af99885cd1c601a10b4e8adb0cb40676152737284e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
68fd96d36c5627069152ea141d88a783

SHA1
dae381431e99db3e0cf7ca600a67c4049aebae30

SHA256
f3677f8def179e6d18263997203c4edc89a1d1d640aafff8aae7fc01b734fb47

SHA512
bc521dcccf367846ff12b3a756fb4539b7a24753cde6eff3babe84e09184be7f785ed41fccb7398f8d4320420cde0b0d6c5ae54fe5fec8a42acc882fe333160c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
00ba35ef2ea3b2b5e968bd1d542e8831

SHA1
f9ed510944e629729c12492efc65d7659781ab8b

SHA256
73e90dcbdf49a169fa00c89c64e911618d88ddc116b96c6b01ae6efa7fcdd3f6

SHA512
e3a930b4ede09afdcba5aa4a5f1cefe397e546b9f6e4e9fc0b335666570658c46d4302e81da86f0a23e8fa25fa55519f21758e76c5087dd162cbaa66ef092df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a42166e45ab9c175bd6d5ec259990308

SHA1
2830ae26f67ebc3f3dd49e8686326d68ca05460d

SHA256
b685deea30911a5543da1345e29354b6a864be8d8a5894978f7e54e52267a3fb

SHA512
b240e745382ba18c7db3177f206e67813c73d1200e3c8f2cf7c3406dd70d6d1f8fd02a421db936dbc48139832abaa79316d03d4b46bb5092ba2cf2095872c791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
06e856eab44b92c9fdaa034b3f16fe75

SHA1
b8d782fbaef075b4f88299d81367263f6235e0fd

SHA256
9a48b06c415750b4c6595b8f468fa749bd5d87bc1d2aff03b45e8c6b6be6bcd7

SHA512
4e85738613a25080593370ec200d10072e215e919842f1a2654811dd53e54532c3c5178fbfa28ae24e217acdd27ba28c758d4556cd9b8ceaa6258ee861db1641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0640ce7b4d2e2784f95db29a490835a8

SHA1
1b7ea2840f966080df96a23c414a70fd1c601f52

SHA256
cfd400303e784d478af06e20a1bcb943af4ab25213c460e8ac0fd4bb70c39988

SHA512
f3fac8980ac42e641ac2cef621da37e421eda11ea16a6442df6929272d7bdbb3c57a990abd29b6cdb0a2169ad608fd3a366c1eca52eb42a697643f58f4fcc5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9ad3ad62bf4e5f7f72295bf3078da187

SHA1
711d9eef524b89a436f29d7773495c6217c12c78

SHA256
0ad40d14b6c041cbe66d4441f2f3bfe9cb4993e4edc38f2fb2540409d697c73e

SHA512
cd0e22532b206455bd2bbd12238737f16af882851e626fca08f4497f1f95a19b9f9ffb16962b914abd7200b1aa7b6cf9daa074aaf4c3bdb88aa722f63e6c8285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7cbffe7115ddbbc4ff82ff7c040f1825

SHA1
8ca6df6867058cc07a8ba92cc4cc26dc6eada265

SHA256
51f3613b04139fb8dda53a5d4457045a6c104b270d5ada2514c586ca552190b1

SHA512
75acb43f0a89c4d10d5f3d87123aa70fe5766e887b103dd6e0caa7b824a9f6648998162ab1b0803162a76567962a743340898880a468998be54ef686d306ae2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b63b520a90c742b04e37e18fae5ab7f5

SHA1
8eeb88e0377fb099a76549a3a191069053445c59

SHA256
d5eec2abdab9eee0e8329672dd51a1739f300c8036adc2943f8e5299e78f212b

SHA512
0534ad1e409fe5f965e7077b4ee5a7d4bd2239f4f390e8bc0f8b1b2a6290fb5705bf4248dc19fe629fb3ae40d86ac073b814950fd9fada6462478082a19b7f0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4a85f1077ee2b2105b1f472ae6935012

SHA1
83d1917d4087564cc4aa7d9475619c0e797c10e9

SHA256
4fb5af6f784ef44b0298e24d0ed4d8fbd50b272fdf42e683a9b1b6305c082b44

SHA512
3c1ed2dd46d9c20b2b8f374bd75ebbf201ae36a08a0dc861910be9eb2c9325438bfeac79f596f65263a14081d804dd482ace6e1173f1d4604c01fffe8a7c852c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d25cd4a9ab3062eacc955890331acd84

SHA1
8ad9282a36fce98d6acb969264a7325d51f25172

SHA256
1ad93d284f783d31d52358279ace0d2da3afdc09660360c870661315975e0641

SHA512
bb83240b09727a5fc0a6f00142449577c88244cd966f67f0fdd7f24fb65fbff3c802618f05fcf476434d6e314f77e2b03a9c76cf30e845c9b62286b8bf29f1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8a57b01c6b2e9a5c5cbad1814fca9880

SHA1
08f5cb9937a07b632960254920db66c0c83fa35a

SHA256
5af92a1e8b27d9a49850b4c3f23705a49a0d0b7222952a191116095927c3437f

SHA512
ed03bb37e7d74160d9473537b5344508b6aa7aa896fa9d1273e549f2af7c6d46125af65fe1cc537f31d0d2f58d968e1b0a3fe21af995f20ff8a80acd52c1aa82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
859555a79b7e8fa456627f3564d82c0e

SHA1
22a3e5640bf4650a1a0c49660c1023d71e1fed21

SHA256
bc2c8935d57b29f81e562df038527971c7102e5ab2f2eaca366af103dc12a0a0

SHA512
17ae112db46a26edcd9b2221f6c426559b353530f1cee0cd5a818484d2bb5be8665038802d7754d50a96273b38b64f060a884b0ba56c136ff60275e0900413c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9a20dd5637535d15c6d885c480be1f07

SHA1
332cd215bb3e04ed65d402ad9e0d3be2f742d431

SHA256
9c31ceed270c5828aceba6d6dc95c4c6c9ac4dec80d3fa3805259e23ff06124b

SHA512
ace05e4de8f9ff5f5b60150165c299f9d83a03e82823999008140a51f73d760d7de1d478b0e288d569aed3e351436f5bc3a42a974daaed7aef94941467bb9628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
Filesize
470B

MD5
4cc514b0930c23b8175239b70ec90372

SHA1
e7e8c50c5740ed77dd54917c30c8ce2f2d1fd149

SHA256
d8f0bf9c084a88738de10d5d0dce75249eb923ef617ce93521cd01a6586fd058

SHA512
09b95ff6d56a316b6e688ca2293c5cb5697c1f9420105e69b39cbbe64d7ba9df521171a41507ed47b337d11ec6c921d01661399274ee4eb87018092ffc1e191a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
7370bbf8efefb5c64d5452912a6bcd4a

SHA1
8267c4d818aa0c69ec96655fb522abd7d61f8f09

SHA256
042dd275340df89a3d5fc130b0d827aa4a5f1f501bd5ee7611ef6a972807ed0d

SHA512
55500869266dde3e2e7b20d2b88c01e28c1625c25c34eddc18f9cf09c84254bbb2a6dc80a0ddd587f31a9c5bb584ad4aee67de902690e0b0c8d2a84c0129bc40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\MOPFK112\www6.buscaid[1].xml
Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAKF6I7O\caf[1].js
Filesize
143KB

MD5
360875ee03667c27f98814fea9746638

SHA1
12699d41ae2464e17a24054a2907442a89f949f4

SHA256
9858c366dc5795d8e7561fb6c7961b2bd9fbe251464d9d1aa68a6528a701231c

SHA512
92fbc5b333d45672d92cd2bb57c154ae5fbb7f42e9298d2e508c16f25bb0251942b361e39b74e25b1d6dfe23bb5518a60de3579f3e7a4c61e7ad84640a609280

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OIHL8UVG.txt
Filesize
137B

MD5
514dc629d01bce20d166b59aa8d5831d

SHA1
8537c4aea8213b195fdb0d0477a145f4192ebe79

SHA256
bf1076a6c64d0c6835b24fdeae6bb616e0a27c3dd46826a69d1784a85eeb3ec1

SHA512
277ed42637fe2ceb7f41f0e2db202fd75a37f1453947a129da4ac63b430d2eac9fcd5810cb4ee22df75f9eb73d3240ecf7d591e8c2017eaa4d75db00be90049e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PTZN2RD4.txt
Filesize
110B

MD5
34c8526ee24283efbd14d560420ac5c8

SHA1
645e0304cca1a89acf0e132b064ee81b8777d6b1

SHA256
384ce2b7a91e349a763e0321caf26817497cb1205ea4b617e4a7c95d3038de42

SHA512
94935d2f36ca6083c456d2adbd4891f1a153613b248e6b7ea29d4b32d565bddd2b188f223a06bddddc639ed6cb95ea539eff079702eb17cab3156e928eff4f51

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RSVR229V.txt
Filesize
432B

MD5
150091221575da9d2285e6be24921635

SHA1
56b5a0100e501a900aea1171fc86247ac4936794

SHA256
e4ac1e3611f6d252964af4616acad99317df5aa53f75e207b15482bb5260c2c9

SHA512
25e7495b6d54d4059511235b5ab9d20d5b7f36bd871098a22c45a247649f5813adc296bf63aecf5b23670cb5bff9a42cc5292ee63ed2e6123bab6eb5cd4f9671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VDQFSOJ1.txt
Filesize
608B

MD5
753dcc980d14482afa11aa2cb0f2a6b2

SHA1
eaee1a3349f6ae7295b6f870938d408b05a3414f

SHA256
8a54df5b5292450430059ce29bdc9e899bcb2f01bca73ad3bf55e4a689c47fa0

SHA512
c8f16bb1f00b9f2aa955ffb5e0a9bee17200b3d64bd598e2d3d91b3fecbe7d54d5ddf6291166b05b204bd4732affdc5e9844570a517af81dca16ece479aa1ec1

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.6MB

MD5
0113e41018d832aba3aaabe664ac4775

SHA1
dfeedb9da14800ebedb5bf051a8387d35f48986c

SHA256
28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

SHA512
e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.6MB

MD5
0113e41018d832aba3aaabe664ac4775

SHA1
dfeedb9da14800ebedb5bf051a8387d35f48986c

SHA256
28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

SHA512
e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.6MB

MD5
0113e41018d832aba3aaabe664ac4775

SHA1
dfeedb9da14800ebedb5bf051a8387d35f48986c

SHA256
28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

SHA512
e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.6MB

MD5
0113e41018d832aba3aaabe664ac4775

SHA1
dfeedb9da14800ebedb5bf051a8387d35f48986c

SHA256
28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

SHA512
e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
1.6MB

MD5
0113e41018d832aba3aaabe664ac4775

SHA1
dfeedb9da14800ebedb5bf051a8387d35f48986c

SHA256
28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

SHA512
e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
1.6MB

MD5
0113e41018d832aba3aaabe664ac4775

SHA1
dfeedb9da14800ebedb5bf051a8387d35f48986c

SHA256
28555e19770ec1dcc1de1321009b4425ba5ef3c4def46006227d99155fd2f581

SHA512
e5bc1fb426ffd2cceb628425d8c3a5597e2a05e2af15837a0b107ef428243489be0ba62a5c4edda1550430c86f550d676637e802c4af90c3b6aff1f96e37bb9a

Download Submit
memory/268-72-0x0000000000000000-mapping.dmp

Download
memory/952-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-79-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-60-0x000000000041ABB0-mapping.dmp

Download
memory/952-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/952-66-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/952-67-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-70-0x0000000000000000-mapping.dmp

Download
memory/1632-100-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1632-99-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1632-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1632-94-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1632-91-0x0000000000441740-mapping.dmp

Download
memory/1632-90-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1952-54-0x0000000000000000-mapping.dmp

Download
memory/2040-89-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2040-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2040-80-0x000000000041ABB0-mapping.dmp

Download