f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8

Analysis

max time kernel
151s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Size

52KB
MD5

15b2075052e8b14beb46419f6be6b126
SHA1

bca2cb651851586c87d60a7885217f4a59d63620
SHA256

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8
SHA512

0d48546770ce32fdce49f80f7587937fc2409380b3cd6095b0af5ebdca2006c97a8b359fc7ad492870d6371c1b9b784f1dd6fde7e87d784f55a495b32ce10a52
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/wXkfw:IzaEW5gMxZVXf8a3yO10pwX

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE

Modifies system executable filetype association 2 TTPs 62 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

WishfulThinking.exeSERVICES.EXEnEwb0Rn.exef8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exeWINLOGON.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE

Windows security bypass 2 TTPs 25 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

nEwb0Rn.exeWishfulThinking.exeSERVICES.EXEWINLOGON.EXEf8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE

Blocks application from running via registry modification 30 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE

Disables RegEdit via registry modification 10 IoCs

evasion

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 20 IoCs

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exenEwb0Rn.exeWishfulThinking.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXEnEwb0Rn.exeWINLOGON.EXESERVICES.EXESERVICES.EXEWishfulThinking.exeWINLOGON.EXESERVICES.EXEWINLOGON.EXESERVICES.EXE

pid	process
1340	nEwb0Rn.exe
1500	WishfulThinking.exe
1436	WINLOGON.EXE
664	SERVICES.EXE
596	nEwb0Rn.exe
1632	nEwb0Rn.exe
1724	nEwb0Rn.exe
1800	WishfulThinking.exe
980	WishfulThinking.exe
1840	WishfulThinking.exe
1280	WINLOGON.EXE
896	nEwb0Rn.exe
824	WINLOGON.EXE
268	SERVICES.EXE
676	SERVICES.EXE
1580	WishfulThinking.exe
872	WINLOGON.EXE
1604	SERVICES.EXE
1868	WINLOGON.EXE
1692	SERVICES.EXE

Sets file execution options in registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

nEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exef8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe

Loads dropped DLL 28 IoCs

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWINLOGON.EXEWishfulThinking.exeSERVICES.EXE

pid	process
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1340	nEwb0Rn.exe
1340	nEwb0Rn.exe
1436	WINLOGON.EXE
1436	WINLOGON.EXE
1500	WishfulThinking.exe
1500	WishfulThinking.exe
1436	WINLOGON.EXE
1340	nEwb0Rn.exe
1340	nEwb0Rn.exe
1436	WINLOGON.EXE
1436	WINLOGON.EXE
1340	nEwb0Rn.exe
1340	nEwb0Rn.exe
664	SERVICES.EXE
664	SERVICES.EXE
664	SERVICES.EXE
664	SERVICES.EXE
664	SERVICES.EXE
1500	WishfulThinking.exe
1500	WishfulThinking.exe
1500	WishfulThinking.exe
1500	WishfulThinking.exe

Windows security modification 2 TTPs 30 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEf8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exeSERVICES.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WishfulThinking.exeWINLOGON.EXEf8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeSERVICES.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE

Drops desktop.ini file(s) 4 IoCs

Processes:

nEwb0Rn.exeWINLOGON.EXE

description	ioc	process
File opened for modification	C:\desktop.ini	nEwb0Rn.exe
File created	C:\desktop.ini	nEwb0Rn.exe
File opened for modification	C:\desktop.ini	WINLOGON.EXE
File created	C:\desktop.ini	WINLOGON.EXE

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

WINLOGON.EXESERVICES.EXEWishfulThinking.exenEwb0Rn.exe

description	ioc	process
File opened (read-only)	\??\F:	WINLOGON.EXE
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\N:	WINLOGON.EXE
File opened (read-only)	\??\F:	SERVICES.EXE
File opened (read-only)	\??\L:	WishfulThinking.exe
File opened (read-only)	\??\I:	nEwb0Rn.exe
File opened (read-only)	\??\K:	WINLOGON.EXE
File opened (read-only)	\??\P:	SERVICES.EXE
File opened (read-only)	\??\E:	WishfulThinking.exe
File opened (read-only)	\??\R:	WishfulThinking.exe
File opened (read-only)	\??\R:	nEwb0Rn.exe
File opened (read-only)	\??\T:	WINLOGON.EXE
File opened (read-only)	\??\J:	SERVICES.EXE
File opened (read-only)	\??\H:	WishfulThinking.exe
File opened (read-only)	\??\S:	nEwb0Rn.exe
File opened (read-only)	\??\B:	SERVICES.EXE
File opened (read-only)	\??\Z:	SERVICES.EXE
File opened (read-only)	\??\B:	WishfulThinking.exe
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\N:	nEwb0Rn.exe
File opened (read-only)	\??\M:	WINLOGON.EXE
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\Y:	SERVICES.EXE
File opened (read-only)	\??\T:	WishfulThinking.exe
File opened (read-only)	\??\E:	nEwb0Rn.exe
File opened (read-only)	\??\X:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	nEwb0Rn.exe
File opened (read-only)	\??\L:	SERVICES.EXE
File opened (read-only)	\??\O:	nEwb0Rn.exe
File opened (read-only)	\??\K:	SERVICES.EXE
File opened (read-only)	\??\T:	SERVICES.EXE
File opened (read-only)	\??\X:	SERVICES.EXE
File opened (read-only)	\??\O:	WishfulThinking.exe
File opened (read-only)	\??\W:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\Z:	WishfulThinking.exe
File opened (read-only)	\??\H:	nEwb0Rn.exe
File opened (read-only)	\??\B:	WINLOGON.EXE
File opened (read-only)	\??\Q:	WINLOGON.EXE
File opened (read-only)	\??\S:	SERVICES.EXE
File opened (read-only)	\??\J:	WishfulThinking.exe
File opened (read-only)	\??\F:	nEwb0Rn.exe
File opened (read-only)	\??\U:	WINLOGON.EXE
File opened (read-only)	\??\X:	WINLOGON.EXE
File opened (read-only)	\??\U:	nEwb0Rn.exe
File opened (read-only)	\??\I:	WINLOGON.EXE
File opened (read-only)	\??\N:	SERVICES.EXE
File opened (read-only)	\??\I:	WishfulThinking.exe
File opened (read-only)	\??\P:	WishfulThinking.exe
File opened (read-only)	\??\K:	nEwb0Rn.exe
File opened (read-only)	\??\W:	WINLOGON.EXE
File opened (read-only)	\??\G:	SERVICES.EXE
File opened (read-only)	\??\W:	SERVICES.EXE
File opened (read-only)	\??\N:	WishfulThinking.exe
File opened (read-only)	\??\G:	WINLOGON.EXE
File opened (read-only)	\??\S:	WINLOGON.EXE
File opened (read-only)	\??\E:	SERVICES.EXE
File opened (read-only)	\??\I:	SERVICES.EXE
File opened (read-only)	\??\G:	WishfulThinking.exe
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\V:	SERVICES.EXE
File opened (read-only)	\??\B:	nEwb0Rn.exe
File opened (read-only)	\??\Y:	nEwb0Rn.exe
File opened (read-only)	\??\J:	WINLOGON.EXE

Drops file in System32 directory 30 IoCs

Processes:

WishfulThinking.exeWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exef8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\DamageControl.scr	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\JawsOfLife.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe

Drops file in Windows directory 18 IoCs

Processes:

WishfulThinking.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exef8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exe

description	ioc	process
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 45 IoCs

evasion

Processes:

WINLOGON.EXESERVICES.EXEf8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exeWishfulThinking.exenEwb0Rn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	WINLOGON.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEf8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exeSERVICES.EXEWishfulThinking.exeWINLOGON.EXEnEwb0Rn.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe

Modifies registry class 64 IoCs

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe

pid process

1964 f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

nEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exe

pid process

1340 nEwb0Rn.exe
1436 WINLOGON.EXE
664 SERVICES.EXE
1500 WishfulThinking.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exenEwb0Rn.exeWishfulThinking.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXEnEwb0Rn.exeWINLOGON.EXESERVICES.EXESERVICES.EXEWishfulThinking.exeWINLOGON.EXESERVICES.EXEWINLOGON.EXESERVICES.EXE

pid	process
1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
1340	nEwb0Rn.exe
1500	WishfulThinking.exe
1436	WINLOGON.EXE
664	SERVICES.EXE
1632	nEwb0Rn.exe
1724	nEwb0Rn.exe
596	nEwb0Rn.exe
980	WishfulThinking.exe
1800	WishfulThinking.exe
1840	WishfulThinking.exe
1280	WINLOGON.EXE
896	nEwb0Rn.exe
824	WINLOGON.EXE
268	SERVICES.EXE
676	SERVICES.EXE
1580	WishfulThinking.exe
872	WINLOGON.EXE
1604	SERVICES.EXE
1868	WINLOGON.EXE
1692	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	pid	process	target process
PID 1964 wrote to memory of 1340	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	nEwb0Rn.exe
PID 1964 wrote to memory of 1340	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	nEwb0Rn.exe
PID 1964 wrote to memory of 1340	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	nEwb0Rn.exe
PID 1964 wrote to memory of 1340	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	nEwb0Rn.exe
PID 1964 wrote to memory of 1500	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WishfulThinking.exe
PID 1964 wrote to memory of 1500	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WishfulThinking.exe
PID 1964 wrote to memory of 1500	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WishfulThinking.exe
PID 1964 wrote to memory of 1500	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WishfulThinking.exe
PID 1964 wrote to memory of 1436	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WINLOGON.EXE
PID 1964 wrote to memory of 1436	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WINLOGON.EXE
PID 1964 wrote to memory of 1436	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WINLOGON.EXE
PID 1964 wrote to memory of 1436	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	WINLOGON.EXE
PID 1964 wrote to memory of 664	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	SERVICES.EXE
PID 1964 wrote to memory of 664	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	SERVICES.EXE
PID 1964 wrote to memory of 664	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	SERVICES.EXE
PID 1964 wrote to memory of 664	1964	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe	SERVICES.EXE
PID 1340 wrote to memory of 596	1340	nEwb0Rn.exe	nEwb0Rn.exe
PID 1340 wrote to memory of 596	1340	nEwb0Rn.exe	nEwb0Rn.exe
PID 1340 wrote to memory of 596	1340	nEwb0Rn.exe	nEwb0Rn.exe
PID 1340 wrote to memory of 596	1340	nEwb0Rn.exe	nEwb0Rn.exe
PID 1500 wrote to memory of 1724	1500	WishfulThinking.exe	nEwb0Rn.exe
PID 1500 wrote to memory of 1724	1500	WishfulThinking.exe	nEwb0Rn.exe
PID 1500 wrote to memory of 1724	1500	WishfulThinking.exe	nEwb0Rn.exe
PID 1500 wrote to memory of 1724	1500	WishfulThinking.exe	nEwb0Rn.exe
PID 1436 wrote to memory of 1632	1436	WINLOGON.EXE	nEwb0Rn.exe
PID 1436 wrote to memory of 1632	1436	WINLOGON.EXE	nEwb0Rn.exe
PID 1436 wrote to memory of 1632	1436	WINLOGON.EXE	nEwb0Rn.exe
PID 1436 wrote to memory of 1632	1436	WINLOGON.EXE	nEwb0Rn.exe
PID 1340 wrote to memory of 1800	1340	nEwb0Rn.exe	WishfulThinking.exe
PID 1340 wrote to memory of 1800	1340	nEwb0Rn.exe	WishfulThinking.exe
PID 1340 wrote to memory of 1800	1340	nEwb0Rn.exe	WishfulThinking.exe
PID 1340 wrote to memory of 1800	1340	nEwb0Rn.exe	WishfulThinking.exe
PID 1436 wrote to memory of 980	1436	WINLOGON.EXE	WishfulThinking.exe
PID 1436 wrote to memory of 980	1436	WINLOGON.EXE	WishfulThinking.exe
PID 1436 wrote to memory of 980	1436	WINLOGON.EXE	WishfulThinking.exe
PID 1436 wrote to memory of 980	1436	WINLOGON.EXE	WishfulThinking.exe
PID 1500 wrote to memory of 1840	1500	WishfulThinking.exe	WishfulThinking.exe
PID 1500 wrote to memory of 1840	1500	WishfulThinking.exe	WishfulThinking.exe
PID 1500 wrote to memory of 1840	1500	WishfulThinking.exe	WishfulThinking.exe
PID 1500 wrote to memory of 1840	1500	WishfulThinking.exe	WishfulThinking.exe
PID 1436 wrote to memory of 1280	1436	WINLOGON.EXE	WINLOGON.EXE
PID 1436 wrote to memory of 1280	1436	WINLOGON.EXE	WINLOGON.EXE
PID 1436 wrote to memory of 1280	1436	WINLOGON.EXE	WINLOGON.EXE
PID 1436 wrote to memory of 1280	1436	WINLOGON.EXE	WINLOGON.EXE
PID 664 wrote to memory of 896	664	SERVICES.EXE	nEwb0Rn.exe
PID 664 wrote to memory of 896	664	SERVICES.EXE	nEwb0Rn.exe
PID 664 wrote to memory of 896	664	SERVICES.EXE	nEwb0Rn.exe
PID 664 wrote to memory of 896	664	SERVICES.EXE	nEwb0Rn.exe
PID 1340 wrote to memory of 824	1340	nEwb0Rn.exe	WINLOGON.EXE
PID 1340 wrote to memory of 824	1340	nEwb0Rn.exe	WINLOGON.EXE
PID 1340 wrote to memory of 824	1340	nEwb0Rn.exe	WINLOGON.EXE
PID 1340 wrote to memory of 824	1340	nEwb0Rn.exe	WINLOGON.EXE
PID 1436 wrote to memory of 268	1436	WINLOGON.EXE	SERVICES.EXE
PID 1436 wrote to memory of 268	1436	WINLOGON.EXE	SERVICES.EXE
PID 1436 wrote to memory of 268	1436	WINLOGON.EXE	SERVICES.EXE
PID 1436 wrote to memory of 268	1436	WINLOGON.EXE	SERVICES.EXE
PID 1340 wrote to memory of 676	1340	nEwb0Rn.exe	SERVICES.EXE
PID 1340 wrote to memory of 676	1340	nEwb0Rn.exe	SERVICES.EXE
PID 1340 wrote to memory of 676	1340	nEwb0Rn.exe	SERVICES.EXE
PID 1340 wrote to memory of 676	1340	nEwb0Rn.exe	SERVICES.EXE
PID 664 wrote to memory of 1580	664	SERVICES.EXE	WishfulThinking.exe
PID 664 wrote to memory of 1580	664	SERVICES.EXE	WishfulThinking.exe
PID 664 wrote to memory of 1580	664	SERVICES.EXE	WishfulThinking.exe
PID 664 wrote to memory of 1580	664	SERVICES.EXE	WishfulThinking.exe

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

Processes:

WishfulThinking.exeSERVICES.EXEf8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exenEwb0Rn.exeWINLOGON.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE

C:\Users\Admin\AppData\Local\Temp\f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe
"C:\Users\Admin\AppData\Local\Temp\f8bda8f7b883a80bb3e7953b0978c6be9c3284035acff88e46687979f7df58d8.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1964

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1340

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:596

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:676

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1500

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1436

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:980

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:664

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:896

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1580

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:872

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
e04b5693b1c997add0a3993591bf27c5

SHA1
e92eda2ee6faa199cd1f7eafe6d8fe9dd8bce6e2

SHA256
9c406010145d6a0e31ecc0befe375593d0831a73840065042226a3413abe6ad8

SHA512
788cafc84832a53e43faea5043a0e1cfda444b6e27671bb0fd8509de0d4e130ae1eed79d520490f825a198df5bbb696fce77ec761a1d8dca3a42355a2f77c012

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
47beab98538b76ff5d08f420840307f6

SHA1
c9c5c2b345ffcc4f3521c0cd99fa2142d7d2f914

SHA256
d1208a285b92b9ad3f261f82c0e06512a71df54a61c800a2dad9ba8fccf6980e

SHA512
ad5a8cba269dd4d4ff2ac70226a0259a4924dd60b202493bf587430738b9a4e2c35b5e53c907482585aac19834f25b4c643f51f0052fbf652760956f018b9a43

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
82c1997794355646c71d9353a0049c53

SHA1
0ea8331ac5242e547305f51510cdae6d3e4ab133

SHA256
070d16e937e88b993379ee8df7392552eef7df569b6ae3e0973f0c253e9fdc0e

SHA512
cb78a9c1555eca7cc40e3040a96a7bab60f56d80848cdb4bcd5fcfbfd827f2db3152bcddd9803f94b1b875911714565f61f0897c23fba2650564dd6d535b172d

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Windows\MSVBVM60.DLL
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
fa8647077bcbf0ddb991d52a0181c54c

SHA1
3853e0d86984809ed4ee9c93e6eccd313fa27578

SHA256
44bae888fea66f14fa871c9d4bc2df733d5118516b64309099572e45ecbb187a

SHA512
ff1719d7f4e45407a5d32de8bead2ec3a26e071ad24b762cf75caa2145b34db6d8b933fb147c654ba38930b76892b09cbca6a743b1e43b71f57ba646ee16a12e

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
bcf40b0408fac06e36164960b6fd6abf

SHA1
8f649367f794357e685f59d75da068e5a5067268

SHA256
7f89007b827fa90b4b5f9c51b8f6f7ee1b3aa76d78a357ebc1597cb37f921506

SHA512
5be93825ff5daf591c9dd16262eb597d6b3e6c8a4957b280ba9744eb0f61e7f287ba7a1bd5ed51bd3d81e18b0bef8a9a5913829967cd21e5a199f585a2b4b5b1

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
872d21213238afa10641ac07cd6af0e7

SHA1
47e3f81c6277163303f8acebc57e09f7ff889fdd

SHA256
0fda7e74f7e58b2f3cd27c2d010224c8375d57d6e9e0f904e11fb5addc42d83f

SHA512
daaa2eb02e3bd8c95b6ca341fa0781e9612830d975221bc6b14f826797906993b8fe2e4724a16dc07c2885c6d3297faabb247d326c42204312abbafc17f45f85

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
407f17fdb467767bc70c13f58b2ac6eb

SHA1
4594dcfe91f5bd9ef80335d5775d5bf7a7a473c9

SHA256
fcbb6ce1c9e21cdcc93b1b27dd64af850536b0c900e3b9f7c6f2f49446d65a35

SHA512
2ed20055ccb0c13377a57e756205ee904c5c835fd6767095df664898d25a6cfdce10a1059f6123d5494a5157f3f794024fcd37dadf7aecd8eafec7bee3fe6c6c

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
c1e02853482158de77eb70f606906013

SHA1
d4c053983b28bc6dd0080ffdced028bf1e92547d

SHA256
20d96ddaba50a19188397ff3c3371fddb718c4bdf91a0b920856761f43bf636b

SHA512
534cf1ac9f24869797d9fd74d7efa5f4394761e30e6f4182e68c54f9d1451ff461be72bbb6b77f01d7443e16a64807ac7ee1ddc7c8ff99bc7a9a47b31b56bd65

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
155c6618d4a5adb9452893465a6a0282

SHA1
cb2fe5f0c8e002ff418616c0c37946a48cf9d357

SHA256
3b7e22202aabebdf40022c4f1103bd130cf48c7d407fc7f6353a49a6d8042751

SHA512
b2ceacd6fe27d3716694c18adf21b78569851f6f324607ae72b24baa7544bfdf4e37c652ff7a6f407522607d2de89631e53f3a39fac906846ec91d8048032003

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
b9db28af44ce159740a8128fe9182f4c

SHA1
14cbdf390b2c4f4ef6410949d51f70eb27d7c54e

SHA256
18ced70b9e903265ea57e69fd94a89ff2c0a194f76595157bce3ba3185f32f42

SHA512
02f73c7980a4b46813160b0c356452f38a705c5541f94db525e97d44e823042c83c68a2cfd9ad2213efeeaf9dec0663a329f5f952091d92fe9c92be07ea7d120

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
0697b5166ca2a0ad164d0e0c12a10355

SHA1
e53b73296d1a6e68affd9b290f72ce58d64f767f

SHA256
a71f80e6adfec6c8fa6fc0f978e35aca80ae8b0c6ee772a2ef174ef858f3af50

SHA512
d99790d75e995fd71cb18b4e26e64f451a1e01cf2ed5dbc5d1b8a7ab8bbe1f8547defb18321180b8fd425aefc771e168d8087ba5386485d456072a65e66d452d

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
c8cb59409f3e73266866e3db82b7875b

SHA1
0a8a92f2c4857d8314b94b0d692de8eb5e405055

SHA256
ba214768f6193aadfe816c18a250849e469b2c1c7665eddda4f7157cef450cdc

SHA512
e3db836e176218b529818580b4396710c9c13278bf4c221289acce6ddd64b6f7c5a6c8b6a3ac786f3bdcc545b278dac9a5a2f919d9bb7f6df8c5a03519c9b8ae

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
c8cb59409f3e73266866e3db82b7875b

SHA1
0a8a92f2c4857d8314b94b0d692de8eb5e405055

SHA256
ba214768f6193aadfe816c18a250849e469b2c1c7665eddda4f7157cef450cdc

SHA512
e3db836e176218b529818580b4396710c9c13278bf4c221289acce6ddd64b6f7c5a6c8b6a3ac786f3bdcc545b278dac9a5a2f919d9bb7f6df8c5a03519c9b8ae

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
dadbe5a11d05096e1a4af08050125126

SHA1
699184ce664efce0217186e9eef0487cfdd5c3a0

SHA256
8352457bac33a118f2b9ac62b4117dea7cff143a3a9843cd7101448c5ca92735

SHA512
f9a7ee1b58c1415d144916bda1b7ae1c6ac07f3503defc894bc87097c57f12728c9d9196b21a202c8b2e8061473ff06b0598305c5e380abec3b30cc649a8a830

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Filesize
52KB

MD5
8bfc30d3410246e942a7924b0e803c00

SHA1
37ab477d8fa3a17a54a66ce95723fe533fd585e4

SHA256
a194e660207f4d4634cebe62a589cf42ce3d8cb3b6b3a94619fceda6e9d1a857

SHA512
989fbe51770d442a3150cbaff6224737b52bb306cf0efc4c7efecdd79c4493ca1707be1684c716a93e371565706d5ca851362a6a7d16d974d61993f21d869449

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
c5b5da4e1841a1a85a55a7f8f426d6a6

SHA1
7a2715caa862d451ec0350ebb7c7bac9df407834

SHA256
99bd3442b51338c6543667bfadf546df13ee8e8e397f30c229495be8ee314eb9

SHA512
97f795d3d9a5cb656a853a83a191aa8b8b9c17aae3bb33c5658c42e6152afc65c77df5a99ed99b6ba440dac8230e52f154cf30ed3d4adaeb86819f12ef8cfb4a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
f05f44fae450277b475a2e7ba0c0fd66

SHA1
1dacc59c3ac6d5e7bcaf2ce6d5c747f561b938f8

SHA256
d64e016c1aec395dc4808501c97d0f1a71e94d6dcd914ac51f45137180714e45

SHA512
08298e3780bd4567d9f19d688a002dc85f2836fb2dbe0aa5bf990c6ebb0ae4ff24ce2fc16f0eff007944ec80901fd979ddaaef91a5e70b07971b367c629b554a

Download Submit
memory/268-193-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/268-183-0x0000000000000000-mapping.dmp

Download
memory/596-154-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/596-106-0x0000000000000000-mapping.dmp

Download
memory/664-221-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/664-85-0x0000000000000000-mapping.dmp

Download
memory/664-177-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/664-206-0x0000000000530000-0x0000000000558000-memory.dmp

Filesize
160KB

Download
memory/676-185-0x0000000000000000-mapping.dmp

Download
memory/676-195-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/824-188-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/824-179-0x0000000000000000-mapping.dmp

Download
memory/872-201-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/872-198-0x0000000000000000-mapping.dmp

Download
memory/896-192-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/896-178-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/896-165-0x0000000000000000-mapping.dmp

Download
memory/980-166-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/980-143-0x0000000000000000-mapping.dmp

Download
memory/1280-184-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1280-164-0x0000000000000000-mapping.dmp

Download
memory/1340-79-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1340-57-0x0000000000000000-mapping.dmp

Download
memory/1340-216-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1436-174-0x00000000027E0000-0x0000000002808000-memory.dmp

Filesize
160KB

Download
memory/1436-175-0x00000000027E0000-0x0000000002808000-memory.dmp

Filesize
160KB

Download
memory/1436-215-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1436-220-0x00000000027E0000-0x0000000002808000-memory.dmp

Filesize
160KB

Download
memory/1436-71-0x0000000000000000-mapping.dmp

Download
memory/1436-82-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1436-218-0x00000000027E0000-0x0000000002808000-memory.dmp

Filesize
160KB

Download
memory/1500-217-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1500-173-0x0000000000690000-0x00000000006B8000-memory.dmp

Filesize
160KB

Download
memory/1500-219-0x0000000000690000-0x00000000006B8000-memory.dmp

Filesize
160KB

Download
memory/1500-64-0x0000000000000000-mapping.dmp

Download
memory/1500-81-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-197-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-189-0x0000000000000000-mapping.dmp

Download
memory/1604-202-0x0000000000000000-mapping.dmp

Download
memory/1604-205-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1632-150-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1632-126-0x0000000000000000-mapping.dmp

Download
memory/1692-211-0x0000000000000000-mapping.dmp

Download
memory/1692-214-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-156-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-116-0x0000000000000000-mapping.dmp

Download
memory/1800-176-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1800-139-0x0000000000000000-mapping.dmp

Download
memory/1840-168-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1840-153-0x0000000000000000-mapping.dmp

Download
memory/1868-207-0x0000000000000000-mapping.dmp

Download
memory/1868-210-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1964-90-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1964-73-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1964-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1964-80-0x0000000000740000-0x0000000000768000-memory.dmp

Filesize
160KB

Download
memory/1964-75-0x0000000000740000-0x0000000000768000-memory.dmp

Filesize
160KB

Download
memory/1964-77-0x0000000000740000-0x0000000000768000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads