6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
Size

855KB
MD5

44096bae1ae755f2165f19b3dbf20870
SHA1

c8ab70294abdc918d69ad049db03d1ca1be7b14c
SHA256

6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d
SHA512

3fb769387fc3419593cc8496830523af701703cc824563a2084b5f36901a4a1b717bc00e6e5f317abc39dcb7d927381108bbf41ca27fcd9b7361cf38f62d26dc
SSDEEP

1536:ehqF+u1LAn+5eHByhdNMcmTcHEnStBFwYAuPzJU3LZlYbr5A/zdHnAkUEocqgvJM:xvm4VMcmYAYjPzcfYf5Ard2EorYDk+W

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 4 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid process

1096 winlogon.exe
1192 winlogon.exe
1792 winlogon.exe
224 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1096	winlogon.exe
1192	winlogon.exe
1792	winlogon.exe
224	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgm32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSQRY32.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Restart.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwsc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efinet32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsysnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ogrc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tftpd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEINSTAL.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explored.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mu0311ad.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ncinst4.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfw2en.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findviru.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sh.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOASB.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanh95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4276-132-0x0000000000A90000-0x0000000000ACB000-memory.dmp	upx
behavioral2/memory/2024-135-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4276-137-0x0000000000A90000-0x0000000000ACB000-memory.dmp	upx
behavioral2/memory/2024-138-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2024-139-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1192-151-0x0000000000F90000-0x0000000000FCB000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2024-149-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2024-145-0x0000000000A90000-0x0000000000ACB000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2024-143-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1792-157-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1096-156-0x0000000000F90000-0x0000000000FCB000-memory.dmp	upx
behavioral2/memory/1792-158-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/224-162-0x0000000000400000-0x0000000000443000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/224-165-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/224-166-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/1792-169-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/224-170-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/224-171-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 4276 set thread context of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 1096 set thread context of 1792	1096	winlogon.exe	winlogon.exe
PID 1792 set thread context of 224	1792	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exewinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998409"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1333756105"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://kn8f7907zcd0e7g.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e3f75989ffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7AA39725-6B7C-11ED-B8D8-DAA3C5DFCF8A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000161ea075c7d56a4ca5206793200a013b843d359b6259a88f14a59172a80fcc4f000000000e8000000002000020000000e976911c2bad32599fad5909c94231533c46e25e5684fc64c5218b908d8803b520000000fb486c5291b9914b3fa5d19fbf7dbe163955ab5c24b5531f5bfcffc45fdb59f54000000017a3aaa176c81c73788881e277714706f61fb47299ed30e553bf26a21afe09ae5b6b832a461e3f5693d451674b4b05d98cf68944470119916e0d0f3934b6896b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://f1x2492r8ux3j7a.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02f2b6989ffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1333756105"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://o22d000pt6x7nu1.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998409"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f0000000002000000000010660000000100002000000005006694725fb84c442e3f89e08aad230c3f71d0788d41714cdd005e2a926dc6000000000e80000000020000200000000ba3d76ce8c41cc10893536cf5da60f8c7535a1092ed7569068b77fa689ea18c200000009e6a1b71f2409df4bbcfd0422ef5b725bb0d21d08dc697f0bcbdb78b37b7c1b240000000d010774c68e54eef0fb854bd3406f40d4117fad858ca9f56ff26256787e7de0f9eca40303662ec16c2a57674f18d0ea1295411082c1e6e4da6de71a0e6eebd61	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376006767"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998409"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://8r7n3il2sd3d86p.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://229u60mqpz77qeo.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://u0jcif6g6t4wt9f.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://v9dvp30qd19w4cw.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ee787289ffd801	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://he82j8s747lj691.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000009181b9e8002c0f06bc56e9731084594d4f833acc4b9d0d47e63b7d60cd557530000000000e80000000020000200000000dfca2c59fe5676881cabe2fdefcc6252106eb27a0a7fe7f99c60c46c9de5ab9200000004932358648cf2bfd5850affe5a3668d6c73dec9485308f13db1c8303a758d7f54000000048ad475df9a98db485707c2e17ed886976d02602360cb877f6d9f42b6ee128fe1b08673d5c506b5abcb8f006c0839fb4b3161e8a97d7e1034df7b65067e64fb4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000008e0a209ab44a103107441c3b47b3ea1d855ff52d8465ec9e779fb1e055ff66d9000000000e80000000020000200000002e35692df91dd3e395bea5d1c52f3db735c4663244e0d6e6b3b6c37bfa3da38420000000ad5a160772e3f07bc4c28cb5ae1c67eb4657c3320a3d5476fe72c41d6d25aec840000000697f4d6a41311beaa4dff498ef4ce47a89cde39d576e640a3d0b27fe84ab06ddb75dce66eb9776b24f35416ac6a26ddcbf1c2733c9f09c46234f0360f1e4a6cf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998409"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0deb46389ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://08d5uwpkwb6628h.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://sf97fb70u0z740z.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winlogon.exe

pid process

224 winlogon.exe
224 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 224 winlogon.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exe

pid process

3756 iexplore.exe
3756 iexplore.exe
3756 iexplore.exe
3756 iexplore.exe
3756 iexplore.exe

pid	process
224	winlogon.exe
224	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	224	winlogon.exe

pid	process
3756	iexplore.exe
3756	iexplore.exe
3756	iexplore.exe
3756	iexplore.exe
3756	iexplore.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
2024	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
1792	winlogon.exe
224	winlogon.exe
3756	iexplore.exe
3756	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
3756	iexplore.exe
3756	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
3756	iexplore.exe
3756	iexplore.exe
4452	IEXPLORE.EXE
4452	IEXPLORE.EXE
3756	iexplore.exe
3756	iexplore.exe
3432	IEXPLORE.EXE
3432	IEXPLORE.EXE
3756	iexplore.exe
3756	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
224	winlogon.exe
224	winlogon.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 4276 wrote to memory of 4356	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	svchost.exe
PID 4276 wrote to memory of 4356	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	svchost.exe
PID 4276 wrote to memory of 4356	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	svchost.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 4276 wrote to memory of 2024	4276	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
PID 2024 wrote to memory of 1096	2024	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	winlogon.exe
PID 2024 wrote to memory of 1096	2024	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	winlogon.exe
PID 2024 wrote to memory of 1096	2024	6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe	winlogon.exe
PID 1096 wrote to memory of 4388	1096	winlogon.exe	svchost.exe
PID 1096 wrote to memory of 4388	1096	winlogon.exe	svchost.exe
PID 1096 wrote to memory of 4388	1096	winlogon.exe	svchost.exe
PID 1096 wrote to memory of 1192	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1192	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1192	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1096 wrote to memory of 1792	1096	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 1792 wrote to memory of 224	1792	winlogon.exe	winlogon.exe
PID 3756 wrote to memory of 1836	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 1836	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 1836	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 2240	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 2240	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 2240	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 4452	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 4452	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 4452	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 3432	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 3432	3756	iexplore.exe	IEXPLORE.EXE
PID 3756 wrote to memory of 3432	3756	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
"C:\Users\Admin\AppData\Local\Temp\6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:4356

C:\Users\Admin\AppData\Local\Temp\6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d.exe
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
PID:1192

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:224

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:4388

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3924

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3756 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3756 CREDAT:82954 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3756 CREDAT:17420 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3756 CREDAT:82960 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9

Filesize
1KB

MD5
a1c99ed5cc720ca232c56c4e73375681

SHA1
ebfd9b7f81289f0a28f2cc6e372352421baf102c

SHA256
f02e1336388e1ca55d37479f290419d231c501b17fe9cac36c806c3162837711

SHA512
6ae105ca42d4c87feb22528f506febf0af528909a1a12a62a80b6ae21f60abdb97bed4a260c490e1a436d48bce54b02c37297bf67e865ae2e4ee0be29b9d9864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
dc3df51988ec3854fe426af76baa687b

SHA1
bf1f577821052c75b6ed3672d27cfb3111a4f708

SHA256
475623fae8d02c065b3cc5c840742f2cbb8a2ea7824d95ca93c94cf48b0e8c66

SHA512
6f9c5216a7a4f5e6bd56bfff4a33fa6e049bf3182c7a8d3447df1fc349c565fb83a98c505da5d1d21ae8a78a715a84dbe049c9baff05f98ed46ee81d72246c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
676104ca857ff7d329d05f54d88acc1f

SHA1
798a6028f0c6187c5a6fd17d34b4f49f234b46fe

SHA256
268539f073520f01393d2e6628fece9ae9112ade08f788170dbd2f58c4bac8ba

SHA512
5b50693313b42a5a71c19658e07ca0fb3904d56e8ecdcb2ee380fac713d8310fd6d4eba1974dde566d453ce5bc14f1a122543aa954ccc73d03dac827ad9502dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
f2d89c85e212ef130eac6d92aa534b39

SHA1
1291a316628bb3582421a4af7ad700141c9f15fd

SHA256
4430efe85d4c1c214ec8e4d5cdf0b3b8e39195a3e037b334fdcb93915253cb1f

SHA512
d80608f2fb32d30cac39b853f00bea61d5aadf9eb5fb607e41820f5782986d6a5e2151c38235342a3128649938edf91c4f27e3d5c355ed961c9ad314c762b335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
7055fbc792b81e2fcdb72da9d3e6ad81

SHA1
dec614359d5d9e76c20aadd3d467037e6a9665ff

SHA256
0eb7311d9c9d181942fd9c9ff0217a360ae91829d0dd6df95a8247625eccae34

SHA512
b1a94b289211cba78d11888c30d2e6b16fb21fc21476c69e8c9ae618f169ca02f6ddaeac72e1e8bce3a0ea9f4bfbd4e47005703963b6cdf46773d27c34e16f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
ad6d84486c3194ab2f71ef94912fdddc

SHA1
89aeb9ea77a27510b11762db5acef5654b62ea4b

SHA256
437fe72dd5a616c3db9a8e0c4823731abdd627641879ed511e9cf86994492789

SHA512
0e37e80588d96a6fb9fe34c0d34d688bb64f3540185fa9e2cb1ed0504229003f3bc31be717a390d3acc668bbfb7a1645cc52bb9e4235afc85a23653ead8ad09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
472B

MD5
942e48a42959a84a8fb01744fd2caf86

SHA1
a3659e206ba81e8549afa2d9138060148883ba90

SHA256
7b84fbd99ebee52b8eb3b3d506ffc4ff9d15bd2bd211fc4003a20fe3ef171501

SHA512
924f681dd75a06bd57987ebdaa2dd7f5699dfbcc33388eb51368f907d583b40c8a62524a984550902d2b26831517c6aeb75683a3282f1bd5c256d80d55731138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9

Filesize
458B

MD5
7ea968970f508af744c6fbf8adcc2edd

SHA1
34ab86ec7f65de7c2b97eb4fb6daa5d3b1fc42cf

SHA256
3cfcbd34b148efc00f58fbe74a1f3e66fe73728e5918930861430334d01878be

SHA512
e2d80fdb378ada649b08948283c9cf416c8c09b2c19fc94d29462b8e7f0ac46d1b058be80fd6ce81852790066638e53bf09b6580d875f47ad212a95cd307e167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
f20f9963d3e8d30bd401cc2f7d5fd881

SHA1
107fcfed46f3da26e963f3b358a38c7f9e0e89ee

SHA256
44a5e004fc77a8085f323568fdbdc7787c040ff1bec84b06231794265508e63c

SHA512
4243db51f6f8584f8b4aa4d5648178f2b7b67839f2d0d9926c307517094517b9e07649e378a7d02dae9899d7a85af107d2cae3ade18ad2e7b60a12b5e21b7f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
98108c94f30b6902e1a720087735f6a2

SHA1
6961edcccfff62c9d22abdf86be85dfc09120eba

SHA256
8ec091c9c1715fd8c02a5efea0d12bacfd37c03b059544b95e8617ae7013f342

SHA512
6502f8a23bcbb24913418aef1716343cbfc923b3f6fe878128e37863f1435239e5d81005238bc5ee526af3fce5aad20170a1d2a2b7aa3e115bd2f247bab62ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
61a2802b3180d561da88b966a2fc6be4

SHA1
efc5a7c2515dc4522ec69bcb2a7f4d52e999d89d

SHA256
2c8f8e1811557441de43762f9592ecdb8c1b31d1ef8e5e103426480ed27e354c

SHA512
023f27b86c0c5cce71e186eef3b4e494a18cb14ecf36aed2dcd7d1cc73634685865eebee7a7fcf9f4bb342d57cbe192ba33b779a44e98a38ce45af1ef76839ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a5a080aa19259e7dab1c7e96f3d8cf1e

SHA1
570c2aabb595c47d43e0c125397d390c2a5b1e30

SHA256
a2000d5aa35fd550f76a5b50ee662f38be174f794820ed06d577fdce90699a91

SHA512
f6c8eb3c17efdc93b18f3dc259e579b33acd94d4ac02b749763e82ffba71eda85ed65084d4f119077ca3fae988c538540bfd91be8b5d25c5a67f9c8042a9f474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
227252ab30c9e7130287506e8b6480f5

SHA1
364875e3685dd529e16854ba7b8da002fe82a241

SHA256
378a4c1451b3899aefc38065cbe4d3fd3f4227d51727275e943f1e0e33a97fd9

SHA512
3b7e8747039fdc7086b53fe793f7bc1b9bf4760a6b344826a69152ad0b9f73665ed515d67f9417aab1924c3ce8cfc24eda1677d8b394239c68b685b4f4bcb7c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
26fcc0274775347c03fce74c23be592d

SHA1
a0d522de6ead3c75098b4ed5932e335952ef389b

SHA256
4365889bb8e0b747d9abf67e4599a7d407e5cc1317a56b7bc32846217733f9ea

SHA512
5cafa9c09596f302a24adc6c06a0392dc39169a93f946fb9c55041e0bedc6c23168ecbbd57dfb53e7c59b2a7a626d003b2d10d4d5ff6317e0ddce30c3fa75dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
8f22805da13243a7ea4975f361650122

SHA1
be7ccd22e01deda9c8c8ab6b3c30216df6136d4f

SHA256
653850fae1d83d262b64407e142d3316dc13bf92db624a5f4a40f25f98b72f07

SHA512
07a62d126c44f210ebfa7b3625a51a39c976ccd80cb5daae4c1b0f94e25286321ad3794485a2d8e8a22c6e470b710cf193832cff5aac34574c43cf8ebf76c03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
01d7a98eca81b8ca9ce733dc86420fed

SHA1
a95bbba436ea89ab679bb0a210a952453895149d

SHA256
c5d9b35d5ffec17ffc5e77151a79bd5df26485ab4651edfae473c9e6f2b9a056

SHA512
bf25cceab4a6bdaee10b3388c494d564c090a780a13ab7fa21d8ce0177e1ba4782867155ec3247687204ab284fa7ea545d15303530f0f7ab65ce4c948a13e38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
0f781e01eddb537b88f53e6cbda02434

SHA1
d7f3153589bbbc79831281c814f9c0e5f87cdedb

SHA256
69b5b6a62d4cd6c4d4ec68da63493d27b451ad3b67b19898ee1ccdcd6ddf36e6

SHA512
e2f039c0ae6b9592090eeae2e530ef2fd4f688f1e69f6cb06de1c542946731066c013988afb75488d98b7a32647b5b63b584718365d263a09096aca6685f7eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\B93DX6R3\www6.buscaid[1].xml

Filesize
1KB

MD5
a5fb316f0ea47f519d0735719f8e23fc

SHA1
fe30034bbbdd2f2cbba91fe12b7e44d4f802ea2a

SHA256
b235e7ebcfd5bd240f6171400fa790315c2cb584ce6fea5342514698b161b5e2

SHA512
6252f5c7bcf187844a73423acaee6be9320a3157d07262548ef3650cce7faed040a67d52dc551e27f52a8942e5683ea8070151c7032790d95971447e9f65db78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNC9UXU1\BYLTCJKR.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZGFOTK6W\O8FD3CGH.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
855KB

MD5
44096bae1ae755f2165f19b3dbf20870

SHA1
c8ab70294abdc918d69ad049db03d1ca1be7b14c

SHA256
6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d

SHA512
3fb769387fc3419593cc8496830523af701703cc824563a2084b5f36901a4a1b717bc00e6e5f317abc39dcb7d927381108bbf41ca27fcd9b7361cf38f62d26dc

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
855KB

MD5
44096bae1ae755f2165f19b3dbf20870

SHA1
c8ab70294abdc918d69ad049db03d1ca1be7b14c

SHA256
6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d

SHA512
3fb769387fc3419593cc8496830523af701703cc824563a2084b5f36901a4a1b717bc00e6e5f317abc39dcb7d927381108bbf41ca27fcd9b7361cf38f62d26dc

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
855KB

MD5
44096bae1ae755f2165f19b3dbf20870

SHA1
c8ab70294abdc918d69ad049db03d1ca1be7b14c

SHA256
6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d

SHA512
3fb769387fc3419593cc8496830523af701703cc824563a2084b5f36901a4a1b717bc00e6e5f317abc39dcb7d927381108bbf41ca27fcd9b7361cf38f62d26dc

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
855KB

MD5
44096bae1ae755f2165f19b3dbf20870

SHA1
c8ab70294abdc918d69ad049db03d1ca1be7b14c

SHA256
6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d

SHA512
3fb769387fc3419593cc8496830523af701703cc824563a2084b5f36901a4a1b717bc00e6e5f317abc39dcb7d927381108bbf41ca27fcd9b7361cf38f62d26dc

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
855KB

MD5
44096bae1ae755f2165f19b3dbf20870

SHA1
c8ab70294abdc918d69ad049db03d1ca1be7b14c

SHA256
6723d807f4b496d9f2a85054adfb6242a15d76f9d775918497c38df52ba9af9d

SHA512
3fb769387fc3419593cc8496830523af701703cc824563a2084b5f36901a4a1b717bc00e6e5f317abc39dcb7d927381108bbf41ca27fcd9b7361cf38f62d26dc

Download Submit
memory/224-166-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-170-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-171-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-165-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-162-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-161-0x0000000000000000-mapping.dmp

Download
memory/1096-156-0x0000000000F90000-0x0000000000FCB000-memory.dmp

Filesize
236KB

Download
memory/1096-142-0x0000000000000000-mapping.dmp

Download
memory/1192-148-0x0000000000000000-mapping.dmp

Download
memory/1192-151-0x0000000000F90000-0x0000000000FCB000-memory.dmp

Filesize
236KB

Download
memory/1792-157-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1792-158-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1792-152-0x0000000000000000-mapping.dmp

Download
memory/1792-169-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-134-0x0000000000000000-mapping.dmp

Download
memory/2024-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-145-0x0000000000A90000-0x0000000000ACB000-memory.dmp

Filesize
236KB

Download
memory/2024-149-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4276-132-0x0000000000A90000-0x0000000000ACB000-memory.dmp

Filesize
236KB

Download
memory/4276-137-0x0000000000A90000-0x0000000000ACB000-memory.dmp

Filesize
236KB

Download
memory/4356-133-0x0000000000000000-mapping.dmp

Download
memory/4388-147-0x0000000000000000-mapping.dmp

Download