6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

Analysis

max time kernel
151s
max time network
180s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
Size

212KB
MD5

a5848ff1c72dd9ceb3fd8cc5dfe7cd42
SHA1

c969575fee6acd2cf0bf2356932a104078f65327
SHA256

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003
SHA512

6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8
SSDEEP

3072:1+kZqVeInSk82TfatZ9mD5fvNj6kECsjZ:1jaSk8iCtPmD5Hl6ysN

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1380 winlogon.exe
944 winlogon.exe
1916 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1380	winlogon.exe
944	winlogon.exe
1916	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netcfg.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdoc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdetect.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccpfw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2servic.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icssuppnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpdclnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jammer.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgm32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notstart.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupdate.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservices.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidserver.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsys32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\penis32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpdclnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpftray.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleToolbarInstaller_download_signed.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieBITS.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1072-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1072-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1072-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1072-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1072-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1072-81-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/944-82-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/944-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/944-89-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1916-90-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1916-94-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1916-95-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1916-99-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1916-112-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe

pid	process
1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1744 set thread context of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1380 set thread context of 944	1380	winlogon.exe	winlogon.exe
PID 944 set thread context of 1916	944	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEwinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://16075656779op68.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://2x54330on9b4q9u.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600ff8120a00d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://w2531ida8251hvm.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://i6tl7q3cw00o5zs.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://67ox5h5d5tzcn6w.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://7w484ezge6ncv80.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46681E81-6BFD-11ED-8FA4-466E2F293893} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://m4jc35d70a982r5.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f9d4be846b7f404b8be3794504543d8a00000000020000000000106600000001000020000000a7d4605bffda297284b35fdb2d134265a5612722dcc72d889e1b7466923dbc95000000000e8000000002000020000000b0670608ddbee79215ccf35d3b7066546a43c6fbd96e6b19211a3d316cce7fdb90000000a4416aee35fd3d7c1a36ae94858f0217dad46e6ba434c0653a42f6432dce159101ba873fe2c90ebe48dfc5735acd7d446cf02388e58f5bc7f8301164a079037b73026190ef207e7a09f3e536432d41ef32b13f4a406c54446ca3398a4c7027ca97b4ee2ddf50573058cfa9a56f4cfc71ca9f9a08e68caaaddcd7e640f0140693a21a9d1a5f93d33dbda32947ec64a2154000000050d0849af5e61113b7b4254e9f9ce909e20bb4aab4b3238ab969405d616aa4a1abb7ee019e5e7703c6f9c1f2f5dfb515e2a57d6e7902420125de5b3c901d3384	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376062100"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://oh1a7h5bs531jfw.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f9d4be846b7f404b8be3794504543d8a00000000020000000000106600000001000020000000898c518be594a843a731117023cf8398d140cc98badf145897839d880820a785000000000e8000000002000020000000040db0b40678141227a4a41878e00c7594f9a872a48c35f10953513563ec24fd2000000081505f63f8fc29ca8d7bfb051ef0294a118eea70b7b695caa02c5b1ce7c475eb40000000be18fc94f7df5925ea426adabba9375d291b4e8c8fdf3e87dbafeac228d7f59c8e21d97562c87fea2d0b044e158ee1f8e80f59ed384894a99c0ef380ebcdde83	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://i984ftg9u4f27pp.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://i9kv9177z62c996.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1916 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1916 winlogon.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exe

pid process

756 iexplore.exe
756 iexplore.exe
756 iexplore.exe
756 iexplore.exe
756 iexplore.exe
756 iexplore.exe

pid	process
1916	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1916	winlogon.exe

pid	process
756	iexplore.exe
756	iexplore.exe
756	iexplore.exe
756	iexplore.exe
756	iexplore.exe
756	iexplore.exe

Suspicious use of SetWindowsHookEx 29 IoCs

Processes:

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
944	winlogon.exe
1916	winlogon.exe
756	iexplore.exe
756	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
756	iexplore.exe
756	iexplore.exe
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE
756	iexplore.exe
756	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
756	iexplore.exe
756	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
756	iexplore.exe
756	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
756	iexplore.exe
756	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
1916	winlogon.exe
1916	winlogon.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1744 wrote to memory of 996	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	svchost.exe
PID 1744 wrote to memory of 996	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	svchost.exe
PID 1744 wrote to memory of 996	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	svchost.exe
PID 1744 wrote to memory of 996	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	svchost.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1744 wrote to memory of 1072	1744	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
PID 1072 wrote to memory of 1380	1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	winlogon.exe
PID 1072 wrote to memory of 1380	1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	winlogon.exe
PID 1072 wrote to memory of 1380	1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	winlogon.exe
PID 1072 wrote to memory of 1380	1072	6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe	winlogon.exe
PID 1380 wrote to memory of 1224	1380	winlogon.exe	svchost.exe
PID 1380 wrote to memory of 1224	1380	winlogon.exe	svchost.exe
PID 1380 wrote to memory of 1224	1380	winlogon.exe	svchost.exe
PID 1380 wrote to memory of 1224	1380	winlogon.exe	svchost.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 1380 wrote to memory of 944	1380	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 944 wrote to memory of 1916	944	winlogon.exe	winlogon.exe
PID 756 wrote to memory of 1688	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1688	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1688	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1688	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1628	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1628	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1628	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 1628	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2260	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2260	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2260	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2260	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2528	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2528	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2528	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2528	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2968	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2968	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2968	756	iexplore.exe	IEXPLORE.EXE
PID 756 wrote to memory of 2968	756	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
"C:\Users\Admin\AppData\Local\Temp\6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:996

C:\Users\Admin\AppData\Local\Temp\6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:1224

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1916

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:930825 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275468 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:734230 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:1061913 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
c67ff5b00288b8dbd5cbe4299aeffe5b

SHA1
41bac29433be0040e52215f32f8d90786ca85ef9

SHA256
1c7941605da29f4f02bccf89555ef8bc78d94bd57735daff74653bf54c8257f1

SHA512
1c2c47e1ee5034c36f291472976aa416f72a2f7891e5d52532f804b579c6a5ed153ed25efb5249cbab2c5c755764dd94c8d28db3f78a210c81209c4ea81fbf1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
f7801fe8b983652ae788bc952856c2ed

SHA1
f3898da21792b146a9f856e87ed3520d76277fb8

SHA256
faa1bc8a9887e2dc694ff645546ea16cb96ac4bd1b0c460aef95f2cced100d6b

SHA512
ac642881315553a5a50ee7ab20015809f90c297cdf674f34a1e709859aa1b89fcb9caca242333e862b379cbd2b35991b6e54de56d2e643487f9aa4f984b93a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
7055fbc792b81e2fcdb72da9d3e6ad81

SHA1
dec614359d5d9e76c20aadd3d467037e6a9665ff

SHA256
0eb7311d9c9d181942fd9c9ff0217a360ae91829d0dd6df95a8247625eccae34

SHA512
b1a94b289211cba78d11888c30d2e6b16fb21fc21476c69e8c9ae618f169ca02f6ddaeac72e1e8bce3a0ea9f4bfbd4e47005703963b6cdf46773d27c34e16f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
ad6d84486c3194ab2f71ef94912fdddc

SHA1
89aeb9ea77a27510b11762db5acef5654b62ea4b

SHA256
437fe72dd5a616c3db9a8e0c4823731abdd627641879ed511e9cf86994492789

SHA512
0e37e80588d96a6fb9fe34c0d34d688bb64f3540185fa9e2cb1ed0504229003f3bc31be717a390d3acc668bbfb7a1645cc52bb9e4235afc85a23653ead8ad09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
edf6203fff785a12ca4d3f7c0827d32e

SHA1
6216473becb5ca95214d079103ff8bcf3ff84e85

SHA256
fe90d94e3b4c4238515070e93a31534b141fbd4187a19665148c74fb31a9aa29

SHA512
36446ab186114a3a4dd1567cfebe986bd18bcac2bcb7c74a939a627eff4438a0c337d39ce0651c0fca4f1f42c288c520891d1fd2060510d3702c239f3130a6bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
179e890227a52c6094cff0ee4c54da14

SHA1
c6fc05c2bd60e894156651fe64cf731cf2f63f85

SHA256
3326c529f59cedbdd4d4ed0a58e1a160d3c44e3c61a76fba96fd65ec215dcb6b

SHA512
cbd9b945a500c701f15d2864ecf50ddd46bf3de027e04cb274472b93cc93cd42224f930cfbd8cda9c695e1923950370900fa7700e67ab1b43df03fb9b549bb36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
895076f34e799638b72cc96902f3813a

SHA1
8af34be1e275d97e0c515001cc595faf22c9c65c

SHA256
7444bd71bb265cc320ae7855fb95b03c401b4612b986c424773ac9b1335d3c90

SHA512
5a596790f98aebd076c68a993d22e2b6b2576fa2b65d36a550a04c4181b76e090552f4fee5ff3ca59313312ef3ea7556d85550909aee700539f034436ba46296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24bda1a3013a0cee26f9e74aa10d4814

SHA1
e2fc53b1a0a6a7ce66f9c02692658aca96e1aa38

SHA256
04875e1e10466c15810a64c2d250329accf260c9f2bec53e0700e1f4ae2649ab

SHA512
7f358e0d3d6076b944819d70db7e4da3deb4f69f8a8aaea4d9af74717d711ae2e3fd42d19b059b8d422270c29ade4125fcb65cf330b2dd282e36f1c961af21d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b49fcade7ad882cc079e5b04f254851

SHA1
d588a78c078966e42ba7912bef1d022da4617b0d

SHA256
b80eadad2d001f6a75dfc3446892268bfd7e1f716f1a8a27331050d470f1f4b9

SHA512
3c6b329cc21dfd6332d0aa98f0262a63267efeab94e62758ad8acd6a6675b3142d0a0807359b536331c97d732553958974cbddccbbef4210a0339496b9b589a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c33268ed95ba3aeae977d70235a6f9e

SHA1
b6fcc614f1813fa0aa061f14efb5a7174cfcb998

SHA256
64ddab6bdd49a033d640d0b7ed4a6066b8b6a3ebd0bab7ca0d1af6d4931f3b52

SHA512
16cb661f9613344deb0fb03037edef5fbebeb0c3741cf5962e8c410ece8cd744a0dbc7ff7c208cffcc874d03a07f5943399f82dd7eeaede5c6a5066669d7594c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ef88c04b85d02a7f572345fa2ec5022

SHA1
7d83eebf52a5ebd38f85783a5b969aa90334c92a

SHA256
04db4615db1f03f590ec542e2db5a33471d6d25375a076dbe8757b00aac1abd3

SHA512
0a06a8ebd7ceca575e319f0a985304ca8c122d7bdad45fe95166a3f5af9a846a4ae9fae035949f574fed27f808e04649209c05a600e1dfc72270390ad7664e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4c4d6bbc84332267721fbf9ab6778b

SHA1
1e4f10a331983e01bbe6162d335a164a17a7cd3d

SHA256
c61336d71d32cea1a5938cee4774ec0d9cde8a8e122d2dfe64d8e968a9322cd5

SHA512
c0236db7fe446d2fab6d80dc215f4f0f4a5243c8441dc35441cb9f6d6618cfd76a324599f589af97a0a9a5b17d68cd6ea303d0afd4f44edb6beb6e7cfa2becfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fa12976bd64fb14927ba70397d0af00

SHA1
e40529e334228f6ae3c8a894d2580b35b5b0d0f2

SHA256
4756074db9aecc4c73435469bd7cfa8733639559635cf46f54d6a2444e9c9c94

SHA512
f1635447b4f40fd51cd9c0cc32ceb19c06ede1370cd8049f5fd6a34f464211bbc2a17e8c0ba27569eadedd17ab1b1cd38b62890beddb458d704271b79d9bc404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
835b8ea13a25947f912228c2f993840a

SHA1
9d88105f42c0d5f6ae530ce61556256ddbad9f5f

SHA256
4b9bc635fc328b4a5a7b819cebe4ba7e04680cd684507dfbf86bd3d1141999ca

SHA512
6674895fa333cc248ff187edb5f40c509427be09a728b56782c5190c905f0133b5a1d40b5d31759d2b1d36ae1db36ed261af3a7be3eebd5b5f792d6a12781f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
835b8ea13a25947f912228c2f993840a

SHA1
9d88105f42c0d5f6ae530ce61556256ddbad9f5f

SHA256
4b9bc635fc328b4a5a7b819cebe4ba7e04680cd684507dfbf86bd3d1141999ca

SHA512
6674895fa333cc248ff187edb5f40c509427be09a728b56782c5190c905f0133b5a1d40b5d31759d2b1d36ae1db36ed261af3a7be3eebd5b5f792d6a12781f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
70edc9e9f0bba2415e94c4107f59e149

SHA1
4e299941b535cb3fb9a15231a583103686f4b04f

SHA256
d3611c1bb8bafcc47341181237c4ed8580240e23b11685798520c360919476b9

SHA512
4f8d748269f4c69521e7f50cc1d402cc341f9832a3dec835661a50d11092719f99b96e1409390c5703657d1839789480888814726cd0f9c0c5437376a65d698a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
61b695ca5446c11d6dfa69bd6bc03c01

SHA1
96e455e15b7c2df3e884e0a7b6d1d6c21c0d9eb9

SHA256
513b4ad01e11e917e4315a4f9727450cdacf63666022e1d012800ce42aa8be1f

SHA512
9242cec759038264f099bc8030854baf6762c87bbde9488cc2b5be323929f94d8377bd300e7a5fa81ff2d2633e34a6481298c228fa3f107aad00989a13ccd969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
acf938e7cab936ea6ea4bdbcd4c1a7d4

SHA1
448e3d9decd7e102a332bb74fcdd3e5a532ca3d3

SHA256
d24df6e86be6cd8fd361d740f7ca5496dc77605916a8240fdb9b338d3b08da36

SHA512
4bb8fc144d07c427673f9a6e2a7a3e7528f50b103a2a53df151400bc7e1cfac3566c670e6d575b26c05884f6c1b0869cb9100028c4c7bd649afe5539fc92b7c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1E0GUCBV\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GT02XWLH.txt

Filesize
601B

MD5
06c05dd6ae8621a7dbd321b7e98d40ff

SHA1
377a1d55adadfc95cbc6dbaed4ca367caa623b38

SHA256
6ecb331ff6dba46f702f28995947661b36d018cae9723eecd69d967869f6d41e

SHA512
d3fb25b180e0de8eaceabe7873d8ec52250cd3ff20fa11aaac08a12a93498c2d2e6abd78707c940858862bd93beccf5d9e79e92e7780f1ce7b3394a7df9382f8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
212KB

MD5
a5848ff1c72dd9ceb3fd8cc5dfe7cd42

SHA1
c969575fee6acd2cf0bf2356932a104078f65327

SHA256
6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

SHA512
6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
212KB

MD5
a5848ff1c72dd9ceb3fd8cc5dfe7cd42

SHA1
c969575fee6acd2cf0bf2356932a104078f65327

SHA256
6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

SHA512
6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
212KB

MD5
a5848ff1c72dd9ceb3fd8cc5dfe7cd42

SHA1
c969575fee6acd2cf0bf2356932a104078f65327

SHA256
6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

SHA512
6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
212KB

MD5
a5848ff1c72dd9ceb3fd8cc5dfe7cd42

SHA1
c969575fee6acd2cf0bf2356932a104078f65327

SHA256
6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

SHA512
6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
212KB

MD5
a5848ff1c72dd9ceb3fd8cc5dfe7cd42

SHA1
c969575fee6acd2cf0bf2356932a104078f65327

SHA256
6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

SHA512
6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
212KB

MD5
a5848ff1c72dd9ceb3fd8cc5dfe7cd42

SHA1
c969575fee6acd2cf0bf2356932a104078f65327

SHA256
6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

SHA512
6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8

Download Submit
memory/944-89-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/944-78-0x000000000041AC00-mapping.dmp

Download
memory/944-82-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/944-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/996-54-0x0000000000000000-mapping.dmp

Download
memory/1072-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-60-0x000000000041AC00-mapping.dmp

Download
memory/1072-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-81-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1072-66-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-71-0x0000000000000000-mapping.dmp

Download
memory/1380-69-0x0000000000000000-mapping.dmp

Download
memory/1916-99-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1916-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1916-90-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1916-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1916-94-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1916-91-0x00000000004417D0-mapping.dmp

Download
memory/1916-124-0x0000000003B50000-0x0000000004BB2000-memory.dmp

Filesize
16.4MB

Download