1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

Analysis

max time kernel
151s
max time network
181s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
Size

280KB
MD5

51df0e1acb613484af2349e71637f850
SHA1

ed841521785d4376fe425619b8fc15009b4f1c8f
SHA256

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf
SHA512

8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19
SSDEEP

3072:XD80DhgAPXSOYjEC8nxEp4l79pEvkMDGQA40diM:XDzhnPCOS8n+s7epiQAN

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1716 winlogon.exe
1376 winlogon.exe
704 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1716	winlogon.exe
1376	winlogon.exe
704	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallControlPanel.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shstat.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservices.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fix-it.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Opera_964_int_Setup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpdclnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defscangui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azonealarm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tracert.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrl-421-en-win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pev.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpexec.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drvins32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprotect.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winroute.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/916-54-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/1064-57-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1064-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1064-60-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1064-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1064-64-0x0000000000400000-0x000000000041C000-memory.dmp	upx
\Users\Admin\E696D64614\winlogon.exe	upx
\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/1064-72-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/1716-82-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/1376-89-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/704-90-0x0000000000400000-0x0000000000443000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/704-94-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/704-95-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/704-99-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/704-100-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe

pid	process
1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 916 set thread context of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 1716 set thread context of 1376	1716	winlogon.exe	winlogon.exe
PID 1376 set thread context of 704	1376	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exewinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000091943abf2aa603478d42271ad9ac6f2c000000000200000000001066000000010000200000004b01d8dbc3cc6c8cbb2f083a13ac70e207bc52cc9058a4b25a75197debd5e3a2000000000e8000000002000020000000501a16c01e8628eecb62f85e2dbd5be54173209b5b604fd08bc88d2c9b5e313d90000000dc97af2cee8ac53d634cadcbef3b59682043a28068de0471a17402600842cc4ce4cdf2c073e22acda2b42d03f1ef48f8269e75864c927a66924522abe6e3469665281646b2f949d5a44f0ec333be451360991aa1ae86ef9871b0e16c8cb25a13b6857a123d37d3fbd0618c80b2da73cc026da534fc73178143fc95800d353f3d6ae0e4f49cf68d2122aab77a15220ee14000000029c53c409cf2067ee12784636c1991fd23f1ecc7c1a80e38f4d7927a0bf8226bf4f6ea7970866868d44b25a0b4eae6499a1e46c66ba44306ffc06c737f49dfc6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376006776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202b665989ffd801	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://cz3j6tp36whl0e9.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://a8i6jci465p833v.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://13agc219nq3i644.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81A4A851-6B7C-11ED-AB20-4A12BD72B3C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://6g4j68hr32213wm.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://u0971bz4h0hdr1t.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000091943abf2aa603478d42271ad9ac6f2c00000000020000000000106600000001000020000000af1b9f79982954aa437316dce4b967ecc79a985360e4d9d1aec14b29daede06f000000000e8000000002000020000000598bdae135ae5ed885abf063ec2e4bc4a5c3ba41bc64f9b1263c8b72705e8a6920000000f5be4b59d4e92a57fae723517ad46411abc60be7ddd6d2a66f51cee0ba33472f400000007f0c3236a398babd3fac5a89775ff66fc04adba78ebc8122f567be13a08d276a536c8b2e2a120318ec3d8ff6f3a7c3c67515a8f97fd9f2a06cf5ab615ba986d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://0qlpkj3h3r409un.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://zmw7nztl43nw40z.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://w3ndimu20ob63gv.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://wewt1zjn9yv1z39.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://3869td83u17820l.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

704 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 704 winlogon.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exe

pid process

1480 iexplore.exe
1480 iexplore.exe
1480 iexplore.exe
1480 iexplore.exe
1480 iexplore.exe
1480 iexplore.exe
1480 iexplore.exe

pid	process
704	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	704	winlogon.exe

pid	process
1480	iexplore.exe
1480	iexplore.exe
1480	iexplore.exe
1480	iexplore.exe
1480	iexplore.exe
1480	iexplore.exe
1480	iexplore.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
1376	winlogon.exe
704	winlogon.exe
1480	iexplore.exe
1480	iexplore.exe
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 916 wrote to memory of 1904	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 916 wrote to memory of 1904	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 916 wrote to memory of 1904	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 916 wrote to memory of 1904	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 916 wrote to memory of 1064	916	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 1064 wrote to memory of 1716	1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 1064 wrote to memory of 1716	1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 1064 wrote to memory of 1716	1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 1064 wrote to memory of 1716	1064	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 1716 wrote to memory of 1164	1716	winlogon.exe	svchost.exe
PID 1716 wrote to memory of 1164	1716	winlogon.exe	svchost.exe
PID 1716 wrote to memory of 1164	1716	winlogon.exe	svchost.exe
PID 1716 wrote to memory of 1164	1716	winlogon.exe	svchost.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1716 wrote to memory of 1376	1716	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1376 wrote to memory of 704	1376	winlogon.exe	winlogon.exe
PID 1480 wrote to memory of 1028	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1028	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1028	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1028	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1492	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1492	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1492	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1492	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1952	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1952	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1952	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1952	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2080	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2080	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2080	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2080	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2580	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2580	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2580	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 2580	1480	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
"C:\Users\Admin\AppData\Local\Temp\1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:1164

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:704

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1128

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1028

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:472078 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1492

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:996366 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:1127441 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:209956 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
f2d89c85e212ef130eac6d92aa534b39

SHA1
1291a316628bb3582421a4af7ad700141c9f15fd

SHA256
4430efe85d4c1c214ec8e4d5cdf0b3b8e39195a3e037b334fdcb93915253cb1f

SHA512
d80608f2fb32d30cac39b853f00bea61d5aadf9eb5fb607e41820f5782986d6a5e2151c38235342a3128649938edf91c4f27e3d5c355ed961c9ad314c762b335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
7055fbc792b81e2fcdb72da9d3e6ad81

SHA1
dec614359d5d9e76c20aadd3d467037e6a9665ff

SHA256
0eb7311d9c9d181942fd9c9ff0217a360ae91829d0dd6df95a8247625eccae34

SHA512
b1a94b289211cba78d11888c30d2e6b16fb21fc21476c69e8c9ae618f169ca02f6ddaeac72e1e8bce3a0ea9f4bfbd4e47005703963b6cdf46773d27c34e16f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
ad6d84486c3194ab2f71ef94912fdddc

SHA1
89aeb9ea77a27510b11762db5acef5654b62ea4b

SHA256
437fe72dd5a616c3db9a8e0c4823731abdd627641879ed511e9cf86994492789

SHA512
0e37e80588d96a6fb9fe34c0d34d688bb64f3540185fa9e2cb1ed0504229003f3bc31be717a390d3acc668bbfb7a1645cc52bb9e4235afc85a23653ead8ad09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b2f667429b95b9035b0c5ffc21bce11a

SHA1
fc7576e589a58c02ff2e6dcbbbf4b66e96b3f471

SHA256
fcdc628ade61e11cf77c337584b3002a6ee5acc1518b2e7aaf653a40c5d58554

SHA512
701e7ec11ea0395caa4e44d6f9373f7ea925c9241c8cab0d26daf128705412735a6eb667f7da20d4132eb485fac34ae0511bd3f4d54fb38da29c4e5ea4503938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
08292858353811b0c1c335b64cc1613e

SHA1
1bc463a2fab94de3ea9d627b6eabc21e49edf380

SHA256
121ec0644a0cf2fc83e396cb4bcc4ee99e693cdd639c07d3fc9ee1b29ec95c92

SHA512
ed8cfcec6e312b9c9bfc4f35568128f16c9648e2ac60ec60efda68368b93e43e0cb7902a1c296edc774afe67ddcc9791c32ff52ae4fec8ca32c8c654b90e854a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
4064d3f010f979e11a4fc9b63f806d9a

SHA1
d9b5aee6b0a46ae4aa730fe775fa234140b741e7

SHA256
990bcc9dfbf02f51cd91e7679506171553c9e67c977872dbc4d80d1cd43f56c1

SHA512
16c8f4382b6c2a1e5fdd20f9660bef406ff5d80ea875e621eec229668f04249bc561fb017fa6fc240c44cc07e84a08ae75b591a10d912958f4cb73928e9de4aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0a0a3bb20e138fa5b00a876d10d6ade

SHA1
d1e0c5505aab86fe28acbe146f7bd538b265accc

SHA256
822a197dc86b16a76b148406bb4fb562e5ca26306b2477c8458d1116e67c214f

SHA512
bdd639f9bd17c9e701031f2b4f9dad773b19c14ec3c5de244a885e406cb6ed10096dd74359f54bbb5ba5294640d4e3c54250455eaab105924ea90a26a3775271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae8c90d780e7a7a0a0296dd4d62c8a48

SHA1
e72794810ed64af31615ef16291dabe5fbd66765

SHA256
f841690b3980ae573566ceb22e2b8d94252139dbc97f5ad257942e099dc5b76a

SHA512
40f21dcc21a5fedd4be0105591dae969d6991a34103b3b2b7d7dc5fc51b075ddbfa4c9042be243ce3d36320a70e8a249b9ce338d62233a5b05d3cabddb1b9f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07c97f6b9d90045d8d042814ce93f9a7

SHA1
d43e9cd44b9eb94d920e639f4954ecc7cd5dc4aa

SHA256
9157f5bc8a56ced550fd50dafa8df1347ebf84f630c9d843ff91e63b166a8611

SHA512
a3ef989968f1f8b195184a0133b28d2c2b5bb5291a571605d50cae6480065abdfbd081808244b0bb1a412723e086ea909d4156c21a1148854118a4b9311d1397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae564be0db16a309fd689893955be932

SHA1
3bc6315150a22984fb52643692202ad0aaced0ba

SHA256
82f1ccfdf6978aa713cc8033968d4c984b718c5e506fcccf7387eace291bbb26

SHA512
84e5d6766255ef6d82b8a4ac6e2a372b96d98d4f15f80a6330e5e9162e436c2800bb4d4aa0840978527e875555a746fe970eb3fecf2a5aba7b021d33c130f146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87f6254e9a2228f932e28b77254bcd69

SHA1
73e79661becd1073de249973325e7dd24b28eb75

SHA256
334504f9b2d75772e31028a3a652acb33d8009fed7fec465026f61fc53aab280

SHA512
af5f79d71aa14aaafb387d42c023cb916ae13d0d83659980c95b1f59ad29a68170a85be9b80a0ef811528fd41e46c3a38092e46f0f0ab1f359bc29fa8a9e51cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c7b449e110bc8c6847c1aeeb5b7d527

SHA1
8c8a9de3a8002a6de6c50263d35aa6f387984052

SHA256
0dfce3a0f1585407cd6779076f789e8c7c9da9e151d19a5f9e3d90afc5f39a68

SHA512
a8e5cbe418a5a1bc4835be93266316b4f918417b2fe6fa20468f16a17c83335c4fffdf63e288c4e65973d1535cb1110604318adba3cd7098723e7072ba65038d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
713846117cb02ac589c3ee755243919c

SHA1
e9d699986eee6be688f9a102a1463d0805616bfa

SHA256
716d70133a326e909257e0ffc71b88e4cd2b21ad82830b1808642f6fc8b6507d

SHA512
b7100af40a67f8cbb1a44f2d5cda670e325dcdc99a8706155461e14c75c69371279e9a8a82cfc77c9a6cd217ad2cec7f525549ad14ef4ae983466ead2a77d653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
16aeaf6aed1514becc784f5e302cbdbc

SHA1
4cfa156688a84707bd32a4b497347aafce10278b

SHA256
85724dd2ccd33e5eef3a728179805039617f72b2c99593f33a4d25baa4736eec

SHA512
85e6aa4ab21be977257dcec3262da4c2e3fd56e2a8f44482bb702975b87a8f6d055b3838aa3eba27d671cd1671459c6b1ab9d6e3fc4797edd97795dcb7446d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
30d6d7fbcf3453855fea299bd791e877

SHA1
65ace606017a59d98fa9e40e5c862c125d3c552c

SHA256
b8f55067eb68be787e1e27dbeba72a62d7c99aacfd65991ec31f4171b921283b

SHA512
f85179a9bb2c00b359c15a1303219a0d09687ba7e1633ef138c120a89d640f269fa490c354be3b22b622528a210cbd685247901a373a278640c62425aa541294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1f998b5852edc335cbeae6d7de70fd92

SHA1
a68cddc3610a6b91f0b28ee435c58e895aca106d

SHA256
e9a033e13cec98258fda90b94daf1edef5af4769502e21d690aaae88d56d9802

SHA512
b97a614dd11ffb3e466045b56ce411ad165f6bffef651827416b9004f87010ba72ff3e45de745dca7701f2b6ee9c9a3e421e830302a32d7a18a8dc9fd3f22d72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JH3HAPCW\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MFHJR5RH.txt

Filesize
608B

MD5
c6af1c2f0530a5e9d2e3f48a78f0a06f

SHA1
8abcfcc48a453e1161c6d6ff8aa931ac2a28d5b9

SHA256
0258c42448b9c26299c31281913b8f903353af301eb911473300d6600484ba31

SHA512
7065d9e936210112399f73a5dc37d903473646ed2f3f7a8c2ba3757c5e67293021134f563ac1380dc677227cf536d9fb9cc297fd4dd110c650a63117fc30edb3

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
memory/704-100-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/704-99-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/704-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/704-94-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/704-91-0x00000000004416B0-mapping.dmp

Download
memory/704-90-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/916-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1064-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-61-0x000000000041AA90-mapping.dmp

Download
memory/1064-67-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1064-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1064-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1164-73-0x0000000000000000-mapping.dmp

Download
memory/1376-80-0x000000000041AA90-mapping.dmp

Download
memory/1376-89-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1716-70-0x0000000000000000-mapping.dmp

Download
memory/1716-82-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1904-55-0x0000000000000000-mapping.dmp

Download