882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5

Analysis

max time kernel
150s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Size

52KB
MD5

3568eaf658a9afa3fc624d503b456080
SHA1

eefc86c79e5c49e8ac18130d5fc6a71d15cf4eca
SHA256

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5
SHA512

8d5bf5a1c2d866b26e2744f6b9d761d675b3bc3c1669988dc9d9de6e1f7406b95c2d2f026eae1c11dd12769fb890a2686ae0f265e4ab533ed28e5980fe309043
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/wSJkfw:IzaEW5gMxZVXf8a3yO10pw0

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE

Modifies system executable filetype association 2 TTPs 62 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

WINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe

Windows security bypass 2 TTPs 25 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE

Blocks application from running via registry modification 30 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

WishfulThinking.exeWINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE

Disables RegEdit via registry modification 10 IoCs

evasion

Processes:

WINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 20 IoCs

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exeWishfulThinking.exeSERVICES.EXEWishfulThinking.exeWINLOGON.EXESERVICES.EXEWINLOGON.EXESERVICES.EXE

pid	process
1708	nEwb0Rn.exe
1248	WishfulThinking.exe
1332	WINLOGON.EXE
1768	SERVICES.EXE
1088	nEwb0Rn.exe
1940	nEwb0Rn.exe
1880	WishfulThinking.exe
1928	WishfulThinking.exe
2004	WINLOGON.EXE
1668	WINLOGON.EXE
1512	SERVICES.EXE
1952	nEwb0Rn.exe
1964	nEwb0Rn.exe
664	WishfulThinking.exe
1916	SERVICES.EXE
304	WishfulThinking.exe
1072	WINLOGON.EXE
1620	SERVICES.EXE
1912	WINLOGON.EXE
1556	SERVICES.EXE

Sets file execution options in registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE

Loads dropped DLL 28 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

pid	process
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
1708	nEwb0Rn.exe
1248	WishfulThinking.exe
1248	WishfulThinking.exe
1708	nEwb0Rn.exe
1708	nEwb0Rn.exe
1708	nEwb0Rn.exe
1248	WishfulThinking.exe
1248	WishfulThinking.exe
1708	nEwb0Rn.exe
1708	nEwb0Rn.exe
1332	WINLOGON.EXE
1332	WINLOGON.EXE
1248	WishfulThinking.exe
1248	WishfulThinking.exe
1768	SERVICES.EXE
1768	SERVICES.EXE
1332	WINLOGON.EXE
1332	WINLOGON.EXE
1332	WINLOGON.EXE
1768	SERVICES.EXE
1768	SERVICES.EXE
1768	SERVICES.EXE

Windows security modification 2 TTPs 30 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeSERVICES.EXEWINLOGON.EXEWishfulThinking.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeSERVICES.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE

Drops desktop.ini file(s) 2 IoCs

Processes:

nEwb0Rn.exe

description ioc process

File opened for modification C:\desktop.ini nEwb0Rn.exe
File created C:\desktop.ini nEwb0Rn.exe

description	ioc	process
File opened for modification	C:\desktop.ini	nEwb0Rn.exe
File created	C:\desktop.ini	nEwb0Rn.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

WishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exe

description	ioc	process
File opened (read-only)	\??\I:	WishfulThinking.exe
File opened (read-only)	\??\E:	WINLOGON.EXE
File opened (read-only)	\??\H:	WINLOGON.EXE
File opened (read-only)	\??\T:	WINLOGON.EXE
File opened (read-only)	\??\N:	SERVICES.EXE
File opened (read-only)	\??\O:	SERVICES.EXE
File opened (read-only)	\??\P:	nEwb0Rn.exe
File opened (read-only)	\??\V:	nEwb0Rn.exe
File opened (read-only)	\??\B:	WishfulThinking.exe
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\W:	WishfulThinking.exe
File opened (read-only)	\??\F:	SERVICES.EXE
File opened (read-only)	\??\G:	SERVICES.EXE
File opened (read-only)	\??\O:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	nEwb0Rn.exe
File opened (read-only)	\??\P:	WishfulThinking.exe
File opened (read-only)	\??\I:	WINLOGON.EXE
File opened (read-only)	\??\O:	WINLOGON.EXE
File opened (read-only)	\??\K:	SERVICES.EXE
File opened (read-only)	\??\J:	SERVICES.EXE
File opened (read-only)	\??\U:	nEwb0Rn.exe
File opened (read-only)	\??\F:	WishfulThinking.exe
File opened (read-only)	\??\K:	WINLOGON.EXE
File opened (read-only)	\??\N:	WINLOGON.EXE
File opened (read-only)	\??\V:	WINLOGON.EXE
File opened (read-only)	\??\B:	SERVICES.EXE
File opened (read-only)	\??\I:	SERVICES.EXE
File opened (read-only)	\??\Q:	SERVICES.EXE
File opened (read-only)	\??\Y:	nEwb0Rn.exe
File opened (read-only)	\??\L:	WishfulThinking.exe
File opened (read-only)	\??\Z:	WishfulThinking.exe
File opened (read-only)	\??\W:	SERVICES.EXE
File opened (read-only)	\??\Z:	SERVICES.EXE
File opened (read-only)	\??\V:	SERVICES.EXE
File opened (read-only)	\??\M:	WishfulThinking.exe
File opened (read-only)	\??\N:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\U:	WINLOGON.EXE
File opened (read-only)	\??\Y:	WINLOGON.EXE
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\T:	SERVICES.EXE
File opened (read-only)	\??\E:	nEwb0Rn.exe
File opened (read-only)	\??\F:	WINLOGON.EXE
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\Z:	WINLOGON.EXE
File opened (read-only)	\??\O:	WishfulThinking.exe
File opened (read-only)	\??\P:	WINLOGON.EXE
File opened (read-only)	\??\P:	SERVICES.EXE
File opened (read-only)	\??\S:	SERVICES.EXE
File opened (read-only)	\??\T:	nEwb0Rn.exe
File opened (read-only)	\??\G:	WishfulThinking.exe
File opened (read-only)	\??\U:	WishfulThinking.exe
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\M:	WINLOGON.EXE
File opened (read-only)	\??\S:	WINLOGON.EXE
File opened (read-only)	\??\R:	SERVICES.EXE
File opened (read-only)	\??\U:	SERVICES.EXE
File opened (read-only)	\??\B:	nEwb0Rn.exe
File opened (read-only)	\??\G:	nEwb0Rn.exe
File opened (read-only)	\??\N:	nEwb0Rn.exe
File opened (read-only)	\??\R:	WishfulThinking.exe
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\E:	SERVICES.EXE
File opened (read-only)	\??\R:	nEwb0Rn.exe

Drops file in System32 directory 32 IoCs

Processes:

SERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXEWishfulThinking.exeWishfulThinking.exeWishfulThinking.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\DamageControl.scr	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File created	C:\Windows\SysWOW64\JawsOfLife.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE

Drops file in Windows directory 20 IoCs

Processes:

WishfulThinking.exeSERVICES.EXEWINLOGON.EXEWishfulThinking.exeWishfulThinking.exeWishfulThinking.exeWishfulThinking.exe882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exe

description	ioc	process
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 45 IoCs

evasion

Processes:

SERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Inanimate"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Animate"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\AutoEndTasks = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

nEwb0Rn.exeWishfulThinking.exeSERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWINLOGON.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWINLOGON.EXEWishfulThinking.exeSERVICES.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE

Modifies registry class 64 IoCs

Processes:

WINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

pid process

852 882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

nEwb0Rn.exeWINLOGON.EXEWishfulThinking.exeSERVICES.EXE

pid process

1708 nEwb0Rn.exe
1332 WINLOGON.EXE
1248 WishfulThinking.exe
1768 SERVICES.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXEWishfulThinking.exenEwb0Rn.exeSERVICES.EXEWINLOGON.EXEWishfulThinking.exeWINLOGON.EXESERVICES.EXESERVICES.EXE

pid	process
852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
1708	nEwb0Rn.exe
1248	WishfulThinking.exe
1332	WINLOGON.EXE
1768	SERVICES.EXE
1088	nEwb0Rn.exe
1940	nEwb0Rn.exe
1880	WishfulThinking.exe
1928	WishfulThinking.exe
2004	WINLOGON.EXE
1668	WINLOGON.EXE
1512	SERVICES.EXE
664	WishfulThinking.exe
1964	nEwb0Rn.exe
1916	SERVICES.EXE
1072	WINLOGON.EXE
304	WishfulThinking.exe
1912	WINLOGON.EXE
1620	SERVICES.EXE
1556	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

description	pid	process	target process
PID 852 wrote to memory of 1708	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 852 wrote to memory of 1708	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 852 wrote to memory of 1708	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 852 wrote to memory of 1708	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 852 wrote to memory of 1248	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 852 wrote to memory of 1248	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 852 wrote to memory of 1248	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 852 wrote to memory of 1248	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 852 wrote to memory of 1332	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 852 wrote to memory of 1332	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 852 wrote to memory of 1332	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 852 wrote to memory of 1332	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 852 wrote to memory of 1768	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 852 wrote to memory of 1768	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 852 wrote to memory of 1768	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 852 wrote to memory of 1768	852	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 1708 wrote to memory of 1088	1708	nEwb0Rn.exe	nEwb0Rn.exe
PID 1708 wrote to memory of 1088	1708	nEwb0Rn.exe	nEwb0Rn.exe
PID 1708 wrote to memory of 1088	1708	nEwb0Rn.exe	nEwb0Rn.exe
PID 1708 wrote to memory of 1088	1708	nEwb0Rn.exe	nEwb0Rn.exe
PID 1248 wrote to memory of 1940	1248	WishfulThinking.exe	nEwb0Rn.exe
PID 1248 wrote to memory of 1940	1248	WishfulThinking.exe	nEwb0Rn.exe
PID 1248 wrote to memory of 1940	1248	WishfulThinking.exe	nEwb0Rn.exe
PID 1248 wrote to memory of 1940	1248	WishfulThinking.exe	nEwb0Rn.exe
PID 1248 wrote to memory of 1928	1248	WishfulThinking.exe	WishfulThinking.exe
PID 1248 wrote to memory of 1928	1248	WishfulThinking.exe	WishfulThinking.exe
PID 1248 wrote to memory of 1928	1248	WishfulThinking.exe	WishfulThinking.exe
PID 1248 wrote to memory of 1928	1248	WishfulThinking.exe	WishfulThinking.exe
PID 1708 wrote to memory of 1880	1708	nEwb0Rn.exe	WishfulThinking.exe
PID 1708 wrote to memory of 1880	1708	nEwb0Rn.exe	WishfulThinking.exe
PID 1708 wrote to memory of 1880	1708	nEwb0Rn.exe	WishfulThinking.exe
PID 1708 wrote to memory of 1880	1708	nEwb0Rn.exe	WishfulThinking.exe
PID 1708 wrote to memory of 2004	1708	nEwb0Rn.exe	WINLOGON.EXE
PID 1708 wrote to memory of 2004	1708	nEwb0Rn.exe	WINLOGON.EXE
PID 1708 wrote to memory of 2004	1708	nEwb0Rn.exe	WINLOGON.EXE
PID 1708 wrote to memory of 2004	1708	nEwb0Rn.exe	WINLOGON.EXE
PID 1248 wrote to memory of 1668	1248	WishfulThinking.exe	WINLOGON.EXE
PID 1248 wrote to memory of 1668	1248	WishfulThinking.exe	WINLOGON.EXE
PID 1248 wrote to memory of 1668	1248	WishfulThinking.exe	WINLOGON.EXE
PID 1248 wrote to memory of 1668	1248	WishfulThinking.exe	WINLOGON.EXE
PID 1708 wrote to memory of 1512	1708	nEwb0Rn.exe	SERVICES.EXE
PID 1708 wrote to memory of 1512	1708	nEwb0Rn.exe	SERVICES.EXE
PID 1708 wrote to memory of 1512	1708	nEwb0Rn.exe	SERVICES.EXE
PID 1708 wrote to memory of 1512	1708	nEwb0Rn.exe	SERVICES.EXE
PID 1332 wrote to memory of 1952	1332	WINLOGON.EXE	nEwb0Rn.exe
PID 1332 wrote to memory of 1952	1332	WINLOGON.EXE	nEwb0Rn.exe
PID 1332 wrote to memory of 1952	1332	WINLOGON.EXE	nEwb0Rn.exe
PID 1332 wrote to memory of 1952	1332	WINLOGON.EXE	nEwb0Rn.exe
PID 1768 wrote to memory of 1964	1768	SERVICES.EXE	nEwb0Rn.exe
PID 1768 wrote to memory of 1964	1768	SERVICES.EXE	nEwb0Rn.exe
PID 1768 wrote to memory of 1964	1768	SERVICES.EXE	nEwb0Rn.exe
PID 1768 wrote to memory of 1964	1768	SERVICES.EXE	nEwb0Rn.exe
PID 1332 wrote to memory of 664	1332	WINLOGON.EXE	WishfulThinking.exe
PID 1332 wrote to memory of 664	1332	WINLOGON.EXE	WishfulThinking.exe
PID 1332 wrote to memory of 664	1332	WINLOGON.EXE	WishfulThinking.exe
PID 1332 wrote to memory of 664	1332	WINLOGON.EXE	WishfulThinking.exe
PID 1248 wrote to memory of 1916	1248	WishfulThinking.exe	SERVICES.EXE
PID 1248 wrote to memory of 1916	1248	WishfulThinking.exe	SERVICES.EXE
PID 1248 wrote to memory of 1916	1248	WishfulThinking.exe	SERVICES.EXE
PID 1248 wrote to memory of 1916	1248	WishfulThinking.exe	SERVICES.EXE
PID 1768 wrote to memory of 304	1768	SERVICES.EXE	WishfulThinking.exe
PID 1768 wrote to memory of 304	1768	SERVICES.EXE	WishfulThinking.exe
PID 1768 wrote to memory of 304	1768	SERVICES.EXE	WishfulThinking.exe
PID 1768 wrote to memory of 304	1768	SERVICES.EXE	WishfulThinking.exe

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE

C:\Users\Admin\AppData\Local\Temp\882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
"C:\Users\Admin\AppData\Local\Temp\882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:852

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1708

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1248

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1928

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1916

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1332

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
PID:1952

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:664

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1768

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1964

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:304

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1912

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
1734c161034d17ee72a1c666b4810077

SHA1
86f53cf42a52dcde6ccca4342620b38f2308ffdb

SHA256
3abdea3b9ab212646cecb5a67df85a0157b5dfd98353bd4cd809fa134e60453e

SHA512
3e47a9b09ecfe1b7aa9224833ade84045a6da5f8d5e93cdc960b1b7e28b7021cfcd88a6aec3e44b650dada7a4ab63862f161065c89e3f4f7de8b6d04df1bccda

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
9120ea0a96e067991e03aceb76fb5ea5

SHA1
3f429cc2de4b14366e5e1b876794ab144e2edafc

SHA256
0224221a9231af669f8a645e215fac7e7776a50b3b0e282d00d3f2f3e39aec5c

SHA512
2f289fb361e1829f639a576ec3ca1e1fbbbdec7862ccd42575542355fab4726cdd46341d9076de5d96e1d6e465f9761fc5bfb34e9f11101d9629f67b94bf8033

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
e6c165ca046a9413b953e51b2b1bce0e

SHA1
96cc7019525eb48f947921165b9477ceb3992359

SHA256
3f149a9a1af6a7a5a97316e6ed877d7cda37c3b38fa1cd4f58a08f9d39382fa2

SHA512
b9635b5b4efb08ccf002ac4fcdbc725a37e073f3a3cc615132427be749279a73e70a56cd147d73c2f4874e3ca69376fc616ff44dc94909cb4bd1a689b92a4653

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
c7c9c79fdfc5a3f01f97a97990086250

SHA1
77bfa1b88857ec26593412749204f0d156ddb58e

SHA256
f758c9099449173715ae053006c813b5c7733b8fffa099c794a79d11bce16374

SHA512
e38e05cba2c8c27f858587954a2064797da6f96de4302f9c5d9baa79e64f7bc09c3dcd16265ee928f537b0c3643a19e0510824381e933923562518e3dd83b20d

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
633525999aac9f63486ec01b19776b16

SHA1
0ed2f20d03c36e64aef0bfa35e892ea0a1b2d982

SHA256
e907fd783498bb7c3b927ba71bdaa54b35fd1b39230ce17b4b7122c09f00abf4

SHA512
61eacbc70b1d7a1f7d0d5a447d1442a52331b4680136382b15d3ad1ee67077bd7c52a41a6702b6e1c1d72267f48185bba67ecb6fa7721f9426e73f9dfe41b00e

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
ef5724c7269a0cc6537b697259d70830

SHA1
91acfb7dc8cefe9e7d08953f655f779f55085466

SHA256
4738eeb27998b6ac75c809cf8dcd6f5473ffa2ec1409631de137d5e316765de8

SHA512
72c8aa242d11658023a3f6d084bae2e23819950f5c0445f46d110bb17a76f26be37a723b6c80b9fc9de49502b3f87a405249c41908d9e1ccb514380de6afbff0

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
19e85cf179e8b3ea68923aeff3f7e8a9

SHA1
ec13bf9880a34b5784518832bc80782905206df2

SHA256
4d4c12b6cb623ef1624b68d753a10865a8f6adb2d803d2edffc55f6c7474aca2

SHA512
e21591e3e364dfe2036186c34ad3c3939234100669875978b84bc0fd17cf8601cdcbb29a8418a05f30d950298c3aadf453eb5ca426145d482e3960e06ea10bb8

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
5e94c1ae2208a5277179b43b12e88e40

SHA1
ff7594128d10d454fe6ef0763cf77ed04b97f139

SHA256
2eaf49bfc88b1d7922e8f8818f673416004852657b997757bbe2ff88373373de

SHA512
30cf349a9329cf06fd98a95cc9c3726f74c249bdb7e30f1471d6e06d74a723845b337a67c5290ded166cf80f3eb16875ba22038bd82268806062b28f7503a33c

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
74e2911120675cf22e42ac280909841e

SHA1
c7a48066a78372f6da4e4e5a93c3088ce1fed627

SHA256
b17257125451efc4e5921c6f34bc2a547bb866185bc6a0e718e993a1d5f916b8

SHA512
aedc3c8ad4b39ec0adefff79bcabc65d4d6ffc2582b28e03f9d1e9d5357693b87fa0678d26f9afec440dbb968a304bb650d59dcfba7a6308e27d751a08184d8b

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
e445a6ac4744dee2070e3d1da49012de

SHA1
4b11edd0b849b7e6d3043dc76bc18c770e817de4

SHA256
c95a45a9b61b9bc6e9792edace1eee3bab1e0b8305464669bf9f16864c2a770a

SHA512
f04fda99804728f893d091bd8005d134af0f4b44ed8c15cb7285445edb2223c781497c2e37033876627e81079e30250f01308c38ee6212c0e1445705b7888ef2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
57607cf4411d1f8e58e3cd8307f3cec4

SHA1
c4d6db774c8de4b80890bdb676ac8a343898eb12

SHA256
f21999f7a7ae5e6c2878e2c01c71d6b688705d0b73d1133b15800f0cd1aff92c

SHA512
8e5b324afa32551327006a3dd852045ade459f8d4cd8010ef31c58c772e2df63b6e96b16df87a90134a8960fa6ddadb832d2269cc47e86111d38b95701f8e6c9

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
2087dba79386585da932195e8751819a

SHA1
54df2a0a3f2205316ad8b2276c8da06c0d8b31da

SHA256
7792e37aa286007f99f0b211781d9a0de8d6c6fa8b9d32a6e6018312bd6ce3ab

SHA512
a33bf5a2116d8da1287ea2839958fd82864fd279003215d7ed1a4ee6af07e2089abc20e5a2032674ff8febdcef441972777c5f747e5233a54522cd0d6e900a15

Download Submit
memory/304-196-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/304-187-0x0000000000000000-mapping.dmp

Download
memory/664-171-0x0000000000000000-mapping.dmp

Download
memory/664-191-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/664-183-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/852-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/852-83-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1072-190-0x0000000000000000-mapping.dmp

Download
memory/1072-198-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-100-0x0000000000000000-mapping.dmp

Download
memory/1088-126-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1248-85-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1248-218-0x0000000002430000-0x0000000002458000-memory.dmp

Filesize
160KB

Download
memory/1248-180-0x0000000002430000-0x0000000002458000-memory.dmp

Filesize
160KB

Download
memory/1248-211-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1248-217-0x0000000002430000-0x0000000002458000-memory.dmp

Filesize
160KB

Download
memory/1248-64-0x0000000000000000-mapping.dmp

Download
memory/1248-214-0x0000000002430000-0x0000000002458000-memory.dmp

Filesize
160KB

Download
memory/1248-176-0x0000000002430000-0x0000000002458000-memory.dmp

Filesize
160KB

Download
memory/1248-178-0x0000000002430000-0x0000000002458000-memory.dmp

Filesize
160KB

Download
memory/1332-71-0x0000000000000000-mapping.dmp

Download
memory/1332-86-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1332-212-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1512-172-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1512-160-0x0000000000000000-mapping.dmp

Download
memory/1556-205-0x0000000000000000-mapping.dmp

Download
memory/1556-209-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1620-197-0x0000000000000000-mapping.dmp

Download
memory/1620-204-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-174-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-153-0x0000000000000000-mapping.dmp

Download
memory/1708-216-0x0000000000380000-0x00000000003A8000-memory.dmp

Filesize
160KB

Download
memory/1708-175-0x0000000000380000-0x00000000003A8000-memory.dmp

Filesize
160KB

Download
memory/1708-210-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1708-57-0x0000000000000000-mapping.dmp

Download
memory/1708-84-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1708-215-0x0000000000380000-0x00000000003A8000-memory.dmp

Filesize
160KB

Download
memory/1768-78-0x0000000000000000-mapping.dmp

Download
memory/1768-213-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1768-87-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1880-125-0x0000000000000000-mapping.dmp

Download
memory/1880-144-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1912-199-0x0000000000000000-mapping.dmp

Download
memory/1912-206-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1916-189-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1916-181-0x0000000000000000-mapping.dmp

Download
memory/1928-123-0x0000000000000000-mapping.dmp

Download
memory/1928-149-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1940-127-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1940-109-0x0000000000000000-mapping.dmp

Download
memory/1952-164-0x0000000000000000-mapping.dmp

Download
memory/1952-170-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1964-169-0x0000000000000000-mapping.dmp

Download
memory/1964-182-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1964-188-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2004-148-0x0000000000000000-mapping.dmp

Download
memory/2004-161-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download