01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
Size

242KB
MD5

debe2eef100475a3f04b089c8fdd03fb
SHA1

caed913841ac8b35c791833c729fd838b6602be5
SHA256

01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb
SHA512

aa9e501da74ef37c1778c3c3200ad0427ed8970d9c0d3e82baa8cc71b0025939a6c5521b6cccfe4f93dc58d1503123f3a10b24bb451e9584790aa89e7312e9e6
SSDEEP

1536:X2n2z/NfmeGrObqqvg5uJhy1haQ2R27sbXu7VUFm10IMSPzY2y76ldFkQZbe4fyQ:wKBmZGqqvgyhy1QRZaum1HBY2uKVDf

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 4 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid process

2864 winlogon.exe
4452 winlogon.exe
2316 winlogon.exe
2280 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
2864	winlogon.exe
4452	winlogon.exe
2316	winlogon.exe
2280	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32INFO.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ORGCHART.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav80try.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccclient.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupvameeval.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IE4UINIT.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRSERVICESUPDATER.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isrv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VACFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcuimgr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\route.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleToolbarInstaller_download_signed.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swsc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3400-135-0x0000000000990000-0x00000000009CB000-memory.dmp	upx
behavioral2/memory/984-136-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1356-138-0x0000000000990000-0x00000000009CB000-memory.dmp	upx
behavioral2/memory/984-139-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/984-140-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/984-143-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2864-148-0x0000000000B80000-0x0000000000BBB000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2864-152-0x0000000000B80000-0x0000000000BBB000-memory.dmp	upx
behavioral2/memory/984-159-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2316-162-0x0000000000B80000-0x0000000000BBB000-memory.dmp	upx
behavioral2/memory/4452-163-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2280-165-0x0000000000400000-0x0000000000443000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/2280-168-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/2280-169-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/2280-172-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/2280-173-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1356 set thread context of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 2864 set thread context of 4452	2864	winlogon.exe	winlogon.exe
PID 4452 set thread context of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 set thread context of 2280	4452	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3524 2316 WerFault.exe winlogon.exe

pid	pid_target	process	target process
3524	2316	WerFault.exe	winlogon.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exewinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3157513911"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998532"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376059780"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d179d50400d901	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://2xxo2o56f76xw01.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998532"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ebf0c50400d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://3kg49p570yh8zo0.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998532"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000ea7984a8559a6cb602f1d4147aca9565724dc52a6b2d427185908319873e97e0000000000e8000000002000020000000942f2c44975a88b8c18e426fadfabad3244d861c531b7d2c86f9abdc8ea8463920000000a72ede065a72bbde765fb781d3b4d9671ca85e1783e4c306b26f13ad3a76df4e4000000032c0660a2ee8b04606ee08a930a77fc321aa64baef0c0923b0ba037f0aa8173498d36dfa8bfd83e1a35cbb9ae1d1a3e2548b28fd1450cb3cc1b9f2165df0b798	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E6ED37AA-6BF7-11ED-B8D8-4ECC57E31487} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000acb1fd104262ef4d4ca2acf21b481f2ff4f94d86a4aa8cb779a476a43e0859ac000000000e800000000200002000000081fa2dcc213d51ee912b33d6a3a290b797fb0fed6e88a3adc51d672754d448dc20000000e88a41d65336b328f104ff51a6d9c63f5428ca6af6eaa0574648e823d88cfc7640000000b60f6d52b499e1c0dc899dc5c5cc98151da10aa255913c384312811ac9cedb89f404625ade5839b8de12dc4b513ee50446dd4db7fafeb14c9c55ace1df51866c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://4m1j8m9wr9vvh7g.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e7d6ce0400d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://nw2x5p06348xt77.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3156620290"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://9hm91xg7j233a89.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3156620290"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998532"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3157513911"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://85hx769eaej1c80.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000006582a732415a41870e5fe5a0183c8b040c52fae892857dce11fd554cd251354a000000000e80000000020000200000006bf691427ed7f4a4ed0b96ab6a7ad8a04d67c94e6d3e722c7618815e08a5e56620000000d48d31e305154797168c48213b28843b85d182d62010e702b0c2b40e6f6bc6224000000033301a21c62beb2a3082b7221c4cf1f55268b3de91edd6146eb98997b8a49ba70bbc6519f1ab343fd96b78363e8ff9bcce0484489298fb17b0f2fb289e1d9b00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://10b688b3522p75v.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://0nozqbf5h6na2m8.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://zn13i4q4mw5v4u8.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winlogon.exe

pid process

2280 winlogon.exe
2280 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 2280 winlogon.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

2876 iexplore.exe
2876 iexplore.exe
2876 iexplore.exe
2876 iexplore.exe

pid	process
2280	winlogon.exe
2280	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	2280	winlogon.exe

pid	process
2876	iexplore.exe
2876	iexplore.exe
2876	iexplore.exe
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
984	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
4452	winlogon.exe
2280	winlogon.exe
2876	iexplore.exe
2876	iexplore.exe
4484	IEXPLORE.EXE
4484	IEXPLORE.EXE
2876	iexplore.exe
2876	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2876	iexplore.exe
2876	iexplore.exe
4340	IEXPLORE.EXE
4340	IEXPLORE.EXE
2876	iexplore.exe
2876	iexplore.exe
4144	IEXPLORE.EXE
4144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1356 wrote to memory of 1808	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	svchost.exe
PID 1356 wrote to memory of 1808	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	svchost.exe
PID 1356 wrote to memory of 1808	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	svchost.exe
PID 1356 wrote to memory of 3400	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 3400	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 3400	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 1356 wrote to memory of 984	1356	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
PID 984 wrote to memory of 2864	984	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	winlogon.exe
PID 984 wrote to memory of 2864	984	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	winlogon.exe
PID 984 wrote to memory of 2864	984	01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe	winlogon.exe
PID 2864 wrote to memory of 2692	2864	winlogon.exe	svchost.exe
PID 2864 wrote to memory of 2692	2864	winlogon.exe	svchost.exe
PID 2864 wrote to memory of 2692	2864	winlogon.exe	svchost.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 2864 wrote to memory of 4452	2864	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2316	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 4452 wrote to memory of 2280	4452	winlogon.exe	winlogon.exe
PID 2876 wrote to memory of 4484	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4484	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4484	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 2724	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 2724	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 2724	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4340	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4340	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4340	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4144	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4144	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 4144	2876	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
"C:\Users\Admin\AppData\Local\Temp\01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1808

C:\Users\Admin\AppData\Local\Temp\01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
2⤵
PID:3400

C:\Users\Admin\AppData\Local\Temp\01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb.exe
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:2692

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Executes dropped EXE
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 80
6⤵
- Program crash
PID:3524

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2316 -ip 2316
1⤵
PID:316

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4404

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:82954 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:17420 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:82960 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9

Filesize
1KB

MD5
4115694acbea57f7be6d861bcc6938ac

SHA1
a045faba435f58082ad14e888d6bb006e1065cee

SHA256
4ffd6a1eb8707803f6b36ef3af09a5aef45e468b2480ffbc159ac76f03515f10

SHA512
005a0c696f49f549f6e6f14d9f5ec6b38c0fabe60bdfbb3a5c4dc3d8fb31bd5b28b40b01bd22f9fd109edf4727cbc18798c3eb360615ededa7d08f6e95ca39fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
65076c459568ff05978d7ddfe4b368cd

SHA1
a5b2b8a31d0f8a9a08e93e93cb5a08a9c424b297

SHA256
b37032c67ee677df0c5cc0e4714511196ed0b307442b19abaf86c1e0a4456ae5

SHA512
f2955d30436e3aa009a9cd7236a5b028a123f968699403f10cbfdfa96e3a1aa660c3ed5e29d5682912beeca076e32a9c27cc586f4e1d6a09577f1dc9b9e0b9a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
676104ca857ff7d329d05f54d88acc1f

SHA1
798a6028f0c6187c5a6fd17d34b4f49f234b46fe

SHA256
268539f073520f01393d2e6628fece9ae9112ade08f788170dbd2f58c4bac8ba

SHA512
5b50693313b42a5a71c19658e07ca0fb3904d56e8ecdcb2ee380fac713d8310fd6d4eba1974dde566d453ce5bc14f1a122543aa954ccc73d03dac827ad9502dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
c67ff5b00288b8dbd5cbe4299aeffe5b

SHA1
41bac29433be0040e52215f32f8d90786ca85ef9

SHA256
1c7941605da29f4f02bccf89555ef8bc78d94bd57735daff74653bf54c8257f1

SHA512
1c2c47e1ee5034c36f291472976aa416f72a2f7891e5d52532f804b579c6a5ed153ed25efb5249cbab2c5c755764dd94c8d28db3f78a210c81209c4ea81fbf1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
f7801fe8b983652ae788bc952856c2ed

SHA1
f3898da21792b146a9f856e87ed3520d76277fb8

SHA256
faa1bc8a9887e2dc694ff645546ea16cb96ac4bd1b0c460aef95f2cced100d6b

SHA512
ac642881315553a5a50ee7ab20015809f90c297cdf674f34a1e709859aa1b89fcb9caca242333e862b379cbd2b35991b6e54de56d2e643487f9aa4f984b93a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
7055fbc792b81e2fcdb72da9d3e6ad81

SHA1
dec614359d5d9e76c20aadd3d467037e6a9665ff

SHA256
0eb7311d9c9d181942fd9c9ff0217a360ae91829d0dd6df95a8247625eccae34

SHA512
b1a94b289211cba78d11888c30d2e6b16fb21fc21476c69e8c9ae618f169ca02f6ddaeac72e1e8bce3a0ea9f4bfbd4e47005703963b6cdf46773d27c34e16f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
ad6d84486c3194ab2f71ef94912fdddc

SHA1
89aeb9ea77a27510b11762db5acef5654b62ea4b

SHA256
437fe72dd5a616c3db9a8e0c4823731abdd627641879ed511e9cf86994492789

SHA512
0e37e80588d96a6fb9fe34c0d34d688bb64f3540185fa9e2cb1ed0504229003f3bc31be717a390d3acc668bbfb7a1645cc52bb9e4235afc85a23653ead8ad09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
472B

MD5
05681a05de8df6e408ae41032401b73f

SHA1
f4824b4863e26866b10cd45a8cb422c339997035

SHA256
97ab2238b53d233622081c75f7c60621eea9ae85c19c7ae958cfdbd685f39ebc

SHA512
3f7fae4f4217048d62321a0af805b6e78f7595b5500e0265d4319153ca0b923caa0294e8279c8c9c4da6528c050099390118208b3de7866b5add70b033016cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9

Filesize
458B

MD5
36fb9774c05e28b6123749dfe93cb62e

SHA1
10e9d9b39dc873083f3b2a41fc3c3cfe6a0e1063

SHA256
294d66e4982d55db7de2125b704e7544623e3cf302009deaeb57e6e4614b7eb6

SHA512
3341144e750938586dc171324ef81eb44ac01ea2b289a901fe5b7b72cd88cb48c94f40735527ab95dae1bcda7e9b05a733d809952492787c84eeb897183802df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
b4634692cd016865080ba4b4a3515f5b

SHA1
21861a43624944bb02cc9e1253f90655198d59f9

SHA256
1c6e1b1dcc70919d200b5b26708c557485837cfd6a75f55d59c84b7bfb9df326

SHA512
a9b6600e6e1339197d207fe4738aacb480add3f21e926687eb49b485b5c9a0f2b7b03eec638c13d920557f47244347de309e370ce21086df22be99dfe69b94f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
5271512e9722375a02752753c03444a3

SHA1
b0354ea29d07db5a32e050ec049c7017c1a8a4ca

SHA256
411c4afe123421b06517e1d01064d9e70ef8daa78dad1fb96cf31cb464f2c60e

SHA512
39c11bee54a9f7b8bbb6238196a045f4de8d6d55b18460dec42fcde103007e5e3353e2c4bf9769b34adad61cda30c22fc4395e94b29c9535118c2d266f4c48ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
339104c015aaabbc8a08fc3a9d47fcc3

SHA1
9f6f5e50bcc241cccb02e46e10a5c25b0aff1aba

SHA256
c47d93b00c7f4d0d08fb80f4657bda86e7a2f63a11a0b3ee515eca0b101e5922

SHA512
c97baec9eea8117d47574f6c510ddb08a4984b5c1e7fd1bec8bffde70478b99c8ff57fd2ae6c60b939325d595406b122732c7f696d25a512f8b4296cbefcf106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
de12d91c97bdb16b332e372874fec7cb

SHA1
d626b083af582ca7bef1eb469ca85d59c98b77c7

SHA256
3ef126101f9d93dd134fc9a31ca4005fb7d691c896b9770ccba5e9a121f67965

SHA512
fef91f3636b52fd24741fd6ff90da45f67ee6f514ef23cc32669944ff2625b7a0717a7be1d3520b63053abb79fb46f22a697828819843e52802b2734dba13798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
6bf568cd7fafebc71e3c432a22421787

SHA1
3e1b0a5e1010b98ca43fc4f87c79ef7f4d6552fb

SHA256
9016afdf9703915f973abe23d27a229c423b3ef4369b7be953efbf0b5d3354d5

SHA512
043f856ec9baa16a34c41534d31f018a47480a818c13c690572f5842c780fd5c0c8c4fee54dc57e8aa63d55d1cf608fed3ae4917733cc93926ab0f0d5fd4995f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
16bd2943f8e9fc570e123195ca2f72e0

SHA1
ecaea95201cca68727fa8b71de68caa4a1659b73

SHA256
9261bc240a56ac2c206182d48b5b8d2c04913595088850f2fca7c72dc5d8ccc6

SHA512
72ed18a9929a842f25f0e07872f3ca0f91c11444ebd869b5908a0ba5ec10c88bbd5e9510dbd62915077b81e0621fbef39bd3640f5d459d1a02113e2aae1d7ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
7d7577ba3318aa7cab45e2db5be4d572

SHA1
09ccbf39d45ba1dc7b7efb1c44f2b2b7c8834e56

SHA256
ff11100bc633ebb6e555e05ef693a4f817416b5a1427d2b81c2777945a28b641

SHA512
d2eb648bc0a43c779f88370e21d9844109f895c26cd46627a9d2292992a1b53512f324829cc585df75148fdf527d8ed1ae860f035ee76a10921df22afb9adfe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
98d43b1d3074425a9d43dabf04fc4b54

SHA1
438f29819322a421d2bafe1db3eeebac5e97a195

SHA256
7bf6a07b6332393ecd087c8becdd0372aef219a103a5905aa76e38224275b9df

SHA512
1fe7998c17b29bcd18266e09f8f07334fea5bab736ce3be7103a2f87d77cd4a7c403b49c3677cac230ac70152fce080d00d7932b39d5b31bb09412c5b642f233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
a44e125a7b8924765ddc73d656cb3a6f

SHA1
b90ed9d7a2f956a20635f18344aa9dfcb35fa912

SHA256
86e780005ff9600b3809186eb65090decf607d50952e2828741cbe042d138eff

SHA512
b4293bb125e2a82156c29e6952f8227fd5e01ebf9b0169e58b6a3f2731ab34aa813edbc93716f8d231f5bddf596d6f660b84b3118858bca65e1362f93fcfd658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ILBEZRK4\www6.buscaid[1].xml

Filesize
1KB

MD5
f5f08544e1aaa50bf30e177055f1e9a0

SHA1
09020399c825f717fc4da769c2d2aa9e04f1f213

SHA256
59e36986949ef71034adf4d4ed4991e0ffefc457370d07e9f76aae66013c5ae6

SHA512
4778a1990a05f028d72aad393eef6fc645c9cb12691fa9f866cd16aaf0b75d3ccffc1a2c264b0cf423b1cffc46d71e806237941185548288dc1432f56d027664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNC9UXU1\AA43F5BM.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNC9UXU1\OC4G72US.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZGFOTK6W\EVN6JCWA.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
242KB

MD5
debe2eef100475a3f04b089c8fdd03fb

SHA1
caed913841ac8b35c791833c729fd838b6602be5

SHA256
01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb

SHA512
aa9e501da74ef37c1778c3c3200ad0427ed8970d9c0d3e82baa8cc71b0025939a6c5521b6cccfe4f93dc58d1503123f3a10b24bb451e9584790aa89e7312e9e6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
242KB

MD5
debe2eef100475a3f04b089c8fdd03fb

SHA1
caed913841ac8b35c791833c729fd838b6602be5

SHA256
01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb

SHA512
aa9e501da74ef37c1778c3c3200ad0427ed8970d9c0d3e82baa8cc71b0025939a6c5521b6cccfe4f93dc58d1503123f3a10b24bb451e9584790aa89e7312e9e6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
242KB

MD5
debe2eef100475a3f04b089c8fdd03fb

SHA1
caed913841ac8b35c791833c729fd838b6602be5

SHA256
01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb

SHA512
aa9e501da74ef37c1778c3c3200ad0427ed8970d9c0d3e82baa8cc71b0025939a6c5521b6cccfe4f93dc58d1503123f3a10b24bb451e9584790aa89e7312e9e6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
242KB

MD5
debe2eef100475a3f04b089c8fdd03fb

SHA1
caed913841ac8b35c791833c729fd838b6602be5

SHA256
01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb

SHA512
aa9e501da74ef37c1778c3c3200ad0427ed8970d9c0d3e82baa8cc71b0025939a6c5521b6cccfe4f93dc58d1503123f3a10b24bb451e9584790aa89e7312e9e6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
242KB

MD5
debe2eef100475a3f04b089c8fdd03fb

SHA1
caed913841ac8b35c791833c729fd838b6602be5

SHA256
01942e3bddff35bab24243924bee4a9a9a1f2f5912f604b5f1166195263a0fdb

SHA512
aa9e501da74ef37c1778c3c3200ad0427ed8970d9c0d3e82baa8cc71b0025939a6c5521b6cccfe4f93dc58d1503123f3a10b24bb451e9584790aa89e7312e9e6

Download Submit
memory/984-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/984-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/984-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/984-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/984-134-0x0000000000000000-mapping.dmp

Download
memory/984-159-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1356-138-0x0000000000990000-0x00000000009CB000-memory.dmp

Filesize
236KB

Download
memory/1808-132-0x0000000000000000-mapping.dmp

Download
memory/2280-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-173-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-172-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-165-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-164-0x0000000000000000-mapping.dmp

Download
memory/2316-162-0x0000000000B80000-0x0000000000BBB000-memory.dmp

Filesize
236KB

Download
memory/2316-158-0x0000000000000000-mapping.dmp

Download
memory/2692-147-0x0000000000000000-mapping.dmp

Download
memory/2864-152-0x0000000000B80000-0x0000000000BBB000-memory.dmp

Filesize
236KB

Download
memory/2864-148-0x0000000000B80000-0x0000000000BBB000-memory.dmp

Filesize
236KB

Download
memory/2864-144-0x0000000000000000-mapping.dmp

Download
memory/3400-135-0x0000000000990000-0x00000000009CB000-memory.dmp

Filesize
236KB

Download
memory/3400-133-0x0000000000000000-mapping.dmp

Download
memory/4452-163-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4452-149-0x0000000000000000-mapping.dmp

Download