8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

Analysis

max time kernel
192s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
Size

1.7MB
MD5

ca15699363e15a3ee3f9f165b9da08c1
SHA1

4db16e87e1e5eda16b716530a313b01f320cbe60
SHA256

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b
SHA512

29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf
SSDEEP

3072:OwHl/Gnrl2wGELlyzXq4D2N3v5FQLffCv7oVJNpUpnrT8vp:tB4rlryzIFQLfqvsPfSUv

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

4740 winlogon.exe
5028 winlogon.exe
1440 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
4740	winlogon.exe
5028	winlogon.exe
1440	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellspyinstall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcadmin.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navauto-protect.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootwarn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32INFO.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2k_76_1436.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieRpcSs.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drvins32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrte.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgssfw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flowprotector.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscanpdsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlh.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav8.0.0.357es.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pev.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfind.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rshell.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3444-134-0x0000000000BF0000-0x0000000000C2C000-memory.dmp	upx
behavioral2/memory/3548-136-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4676-138-0x0000000000BF0000-0x0000000000C2C000-memory.dmp	upx
behavioral2/memory/3548-139-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3548-140-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3548-143-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3548-148-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/4740-152-0x00000000004C0000-0x00000000004FC000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/1440-159-0x0000000000400000-0x0000000000443000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/1440-162-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/1440-163-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/5028-167-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/5028-166-0x00000000004C0000-0x00000000004FC000-memory.dmp	upx
behavioral2/memory/1440-168-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/1440-169-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 4676 set thread context of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4740 set thread context of 5028	4740	winlogon.exe	winlogon.exe
PID 5028 set thread context of 1440	5028	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEwinlogon.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3269164436"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1c1a00a57305449bf04f262fba9776000000000020000000000106600000001000020000000497c90df649bf99087bfd6279c6887c3a241f1e1d8462f66c2af0eb380b58ebc000000000e80000000020000200000006a49763cc690cda9d0343efdb1eb47f620f0085da635d81b0051e30fe770edf62000000072a79a5ba4f5639bbb0d2c56eddc2a7ac1a3886193a805a287fc15e5bea4a5fb40000000983028af2d7fb3f2b8bf2fdaf4745cb6d4ff9b9c83530bf3a798e843a230234bbbfae48ed6bdde6ded09cf909038207025d9e8dd68cee095df3609ff95cd72e8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01698ced800d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://ffb6j152d487o40.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c2d2c5d800d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1c1a00a57305449bf04f262fba9776000000000020000000000106600000001000020000000ddd821fde37904355019b24da33bd6c09a58257b399ee67678b59a34a8a89be0000000000e800000000200002000000012a74cdb1621eae4de022488b8576238b68fe5074e807b02750b533c146695842000000022b5b5bb2f478e2201b39044f3c28df39a616caf453c5e5db07efc2165ed3762400000000c1b6dff4f35407a8fa2db19a7d62886d497a4a5dad73fd50d794d02ebb2b4af48a5fbcf8c252d0fc7290e27ab12c3c1c68ba11ad78d468fc8a1a5e8375943c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3272446446"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c020e8bed800d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1c1a00a57305449bf04f262fba977600000000002000000000010660000000100002000000021dd94e3e3afa2a4e7ae7b50583f72b9b11f917f4290c2a6ea56120d080c44ef000000000e8000000002000020000000244725a96a24914f6358b6e073c69ee062738053e1802ca80dadae6bc3cd61ae2000000010d9febd676c90d15f99c017097fea4e958583302960d6d74959b9f5cc3c4d7e4000000079b7711059d9a0e78377608a3ec4216640b8b8789f5e2d6692fd79f98f0cd8f4acbc370f7968c60c6d124f256ba01c1928ef46ed69d6fa28e2e3f5959c3a278d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d96edfd800d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1c1a00a57305449bf04f262fba9776000000000020000000000106600000001000020000000b9fe9fb6af2c3b1780b9d08ebdfe11e80c3840a2d99dd63ae36a494bedd9ee73000000000e8000000002000020000000a7ebbccbe2e6153ba7dfaf9195c5619f0693e13eea5bf4b22365bef53ca3c98020000000308c56656d5c954017de47361deef40c63cbb0d231923b265182377e9a2534614000000031fc43ccca189d876401ce0e4948c244886920e4824eacdb16476879c91f48c7b05abc20c9839b2f5517a28f1a51fbe503a2b80f17267c5f00e342e7e2ac2943	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EE51F9EC-6CCB-11ED-89AC-E62D9FD3CB0B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998744"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3272446446"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706bcbe5d800d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998744"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://2k0co1u286rc8v6.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://i39520a37k37w6g.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376150853"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998744"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3269164436"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1c1a00a57305449bf04f262fba9776000000000020000000000106600000001000020000000d55c1dcf2c16f84e939468d6aa73a49e59658a9c957e08822b2dc3b73c221d79000000000e8000000002000020000000f3329a1f66e913366fc494d852372efc1488225bf1e035585b6ccea04e3fd6f4200000000ad3bc10874571b25f46a582ceb6603b5b474dda98d20e4b23cff838f7551efc400000007def217dc3e45d7a0557cf17fefbbaed5805727740c02e3d31094dc62d43777ae5e76157445b560a78f26e7ea6b579cbeec385890b40f6141ccddaf079eaed8c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3492330490"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998744"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://bah96zwz17pak53.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://s301120r069cr70.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winlogon.exe

pid process

1440 winlogon.exe
1440 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1440 winlogon.exe
Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exe

pid process

2428 iexplore.exe
2428 iexplore.exe
2428 iexplore.exe
2428 iexplore.exe
2428 iexplore.exe
2428 iexplore.exe
2428 iexplore.exe
2428 iexplore.exe

pid	process
1440	winlogon.exe
1440	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1440	winlogon.exe

pid	process
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 35 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
3548	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
5028	winlogon.exe
1440	winlogon.exe
2428	iexplore.exe
2428	iexplore.exe
332	IEXPLORE.EXE
332	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
3264	IEXPLORE.EXE
3264	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
4488	IEXPLORE.EXE
4488	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
3264	IEXPLORE.EXE
3264	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
4076	IEXPLORE.EXE
4076	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
3264	IEXPLORE.EXE
3264	IEXPLORE.EXE
2428	iexplore.exe
2428	iexplore.exe
4488	IEXPLORE.EXE
4488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 4676 wrote to memory of 4364	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 4676 wrote to memory of 4364	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 4676 wrote to memory of 4364	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 4676 wrote to memory of 3444	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3444	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3444	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 4676 wrote to memory of 3548	4676	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 3548 wrote to memory of 4740	3548	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 3548 wrote to memory of 4740	3548	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 3548 wrote to memory of 4740	3548	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 4740 wrote to memory of 4744	4740	winlogon.exe	svchost.exe
PID 4740 wrote to memory of 4744	4740	winlogon.exe	svchost.exe
PID 4740 wrote to memory of 4744	4740	winlogon.exe	svchost.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 4740 wrote to memory of 5028	4740	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 5028 wrote to memory of 1440	5028	winlogon.exe	winlogon.exe
PID 2428 wrote to memory of 332	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 332	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 332	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 3264	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 3264	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 3264	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 4488	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 4488	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 4488	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 2216	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 2216	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 2216	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 4076	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 4076	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 4076	2428	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
"C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:4364

C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
2⤵
PID:3444

C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:4744

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1440

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:5108

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2128

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:332

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:17420 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3264

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:82950 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:17426 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2216

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:82962 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9
Filesize
1KB

MD5
c1035784218995a89069bf7eed56770a

SHA1
edb7e3843aaaf74ac098cff3c8e91dace0800edc

SHA256
314c6b0a75d27cec302c9ac5937f32bab3a10c1fbdda2d2d1a213aba5ad20d39

SHA512
59229b6bb17938f434b0baa6ac3be3384d58fb6ffe050543ab9f6ef27b136875c9740e53358fc48208dcce7ca8356dcf503740476982c0c3ce95e27c3a65cb56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55
Filesize
503B

MD5
c74ff3a5e1404a75a2104a1cc9e02721

SHA1
3435780a0a850ab859afa3cd172960df5cb823b7

SHA256
45fedcfc62ec4b46563e776676b4f6918293eec31cb42ac00a07077bf775e4ed

SHA512
a6190754cc7e8a5ca38757b8bc09af5feda007418be0f40eb2cd7cc86ed436ad7841e5fe83263918637f25d70dc351d0f5516b3851520c5dd1a20e3e7723a43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
1KB

MD5
ff7a1328d03d89f85e161952e93005e3

SHA1
aecdf98ae95f71037554588c495b547051435260

SHA256
d19e8153c488f20af0d680a62fa4b97d4936f737142fa8abe72f8eb24bff0d10

SHA512
d98ee4f86b3d12de51af1823533bfddf854a101090fc799764b973cb9c00b4c38e298055f02f41fac0091e29e81fc3433483f1186f49d7bf6c6e41e52c03c124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
79341a72b77d23e92e284c609042d185

SHA1
abf2442e615b28ac099c688be99b89e6355573c4

SHA256
0cd273ef624d3e69706595982ee7b74e4e04a6215365b26e77d140442b099ade

SHA512
959810157c0c9af762427aa7810790a82be5a5c28db50c2af64c730aa9bb3e2e8185e88fb5a5812a32f88aeabfaa411c0eba237f7dfd862932223c307c219bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize
472B

MD5
76544babbcf6515110bd81aaee8e7e63

SHA1
043497692868c67ac84cdfe70d0a484517abd1c2

SHA256
a19d5958d683662375a2469d1d7e551188469b967eb6f2bae2d5e43dac51a4f0

SHA512
a23198710b8898b9fe8f9d62841567995b30be60938ebba2a3aad94c4dc7687d5e5d188f3388f939d27833e44a9aec275cdadc815e01d6ce32ae3b9b07d4a561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
Filesize
1KB

MD5
b8914a9f1a906f927cccce6ced9b2d0a

SHA1
416b18e429e5666f291b0b1c2a027540ccac9d98

SHA256
368fea95d9e90df28a6bfddc6b5a4541a082e521f28dca1fda3c0451926fa10d

SHA512
c182123030362c722735903641739a02f42a625f0a0080495b99a70150bbfb5e7a81cb6c88a0bf21b5547308621e1b487947298c8c5ab302b94a7e4bb72190d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
Filesize
1KB

MD5
d416222752f135ed236e638a9446d727

SHA1
705876fb8232b28d61bc23d3a48a42ad293106ed

SHA256
d86e5758fb2d4f5cb0ea9be687e11c7056f094dc24a445971c75e23b97e8d24b

SHA512
25f495232f2f28d41335eaed9a400af4e2942b0d25997b171b9ea9d06a42ebe316a7456d5b08814b47ab924f2f4db0ccad6726a8c62382fa1d3c004e56bcb555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E
Filesize
472B

MD5
312d6119e2a9865fd7bd8752bcf62563

SHA1
fcddb4e1098fe901119e2ec5de135e26b586f897

SHA256
ed8c44b9621baf009fe6320d2c54a97d18fad60c5cc54646ea00384a0198e734

SHA512
50bed9947a82e244a3864fe7bd040d76ac6cb4814ed8aee4ded8442d984ef402eb23f2e53920aa00d52824b7013bf3cfcf9ad1efcd9da132d655eb2c5ecaa099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9
Filesize
458B

MD5
f7be4252b4b6f77f38adcbf7ff776aa7

SHA1
b13349eefd312b30f119708be9cf8080863b9eb5

SHA256
82fd9712ce0ca9cf259fb67e3e0816ae14528e93520fc4727186391fb2ef6772

SHA512
21bccd9ccbcfe6f7a1a069c3a9112329ddd30e012de39bbd02c452318b55e710b3ce53a976a64ca4c2bd5e097948a3fca42d0ed1db828d65bb396fd5a50d4015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55
Filesize
548B

MD5
3b74fe031b2caae6c334d2594752374d

SHA1
25726d68fab54eafa990ea9fa0b81a9573921e19

SHA256
f5d72f2dde1efb724c6f6a2ca3d6e88fdc75fe8f567a890084ffa7efed5843db

SHA512
613706d4c8074b39d5020e4a561afc950ddc303d3df0a081d77a5c556d1a6727437526137223865f4a7f96d7765d145711813e1a6ab2a9c4ca68f560e626ac9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
19335a64d6c8fb34eea407199207c456

SHA1
597317dd97022beca122ebb62e5fba173caf1c9f

SHA256
ad12f59c1c5a59ab6e9d0b48bfb1b5f16d61212b3191e4e7d748fd8d84e45773

SHA512
da6aac60980faa0c175ddd1583b069b9faef5b3fbe7d1f975fde7d8fd63093829b3372f77eabe427b6aaf06553697d39660bb66df4d6a7fcbcd11fe424bcc888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
450B

MD5
0e79054385184ac87851ffc7bbee4181

SHA1
d19d64144cda72709ffe8e20b41fbed435715de5

SHA256
82663b5ad5860ac820d57cc4c3bde365f97a97fcaeada307ed20e8f17521356f

SHA512
ada47fe20cd8ecd1be3e7a0f22f6c577de323e9adb5fa8c8642b7b44ca67fddfd5affb8220f556d82ffa11dc9e88e1b7cd04cc60b2c130d55a392899ef78ff00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
9b7afab378c1aae943bad7d8ed59af20

SHA1
4f7867540b78d05a979fa042aaeb86ce8843a51e

SHA256
c7662d7598c98a8f149e5a8db3cf25836932ee0958cda019fc955bfb10899ee4

SHA512
2f3445f764b090e0f52e1021c1c9652ce9600b8086e8f68498d017f7225e9881b4607772597cdcaf69a846e753b1fe77dc6890e44d7a3564eedd8898f6997d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize
402B

MD5
a6c30fcf93ce481c8dba937051d62ca6

SHA1
dff9bd172ae021c004667038bb749c709e1754ec

SHA256
3ed95eab50220f78daf656a0d8efdac7688bb354e576615cbe28d841a74af56b

SHA512
dd2badf30a8767713b09a6bad45bb3c57b8a08802dad6cb3378a17637375bab6eb9df40405d7a2b86d95027041facdbfdea6dde79934423b612497534895e7c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
Filesize
466B

MD5
4404ce3d2099b78eee2487db333b2634

SHA1
d0755468d9a13bc89d9e6967659c4e59454cd475

SHA256
74db100786acbc4f4cf43e19181e95d19797f66e78b619266ddd0658817f6081

SHA512
2b845d72795c33e620efbd47b0f35c96ed69abc9756b65048914b044d81ff43107621a05ea307a080683b652f0d8846e385978c4708244b6c5f872c4d5d2b864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
Filesize
470B

MD5
362f23c4bd866ae6a21764628b6ad805

SHA1
4c92de1de7c5776cfa9701ae44d95d4f3cf197b3

SHA256
b9b6f77c3e9fac9bd88a57ba70fa1b263c2d2c514a4afb57ff3793a629fd9793

SHA512
92d0d5a61823500677c1829a855ff2884e953d941bb72ac416c079d86839d2795ec024dbe0b01f5f9074672dfa625336a6fd3156898c649f26f7f8613e19acbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
393cd1edd06ab4ed4b3d85eac8ed17b7

SHA1
0c990185912b4bcb3574fe9f374e84ca4a65e148

SHA256
90c194839c0b76d8fad82738969ea0be9d49416813d046262d21be46d0720abb

SHA512
8cb8544e1db3b8d83ab159374739ac71b95c1124f5a11aa72a0ce5737385f25ef6681bf098218a7bfd23272ca1787a93ff3a6fba078b0ab08b0d32f137ebffdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E
Filesize
402B

MD5
e3982989fc0154731bfff762923b45d8

SHA1
f3ba8d86bffd2db6715e29d68dcbf59ab1a6a67a

SHA256
2c6344ad13814fb5c7879cbaa22a4dd2800d09e383b0cf7b22af687fe19a213a

SHA512
08323cfff71b303231c8fbc082146eb4803f5f8a114f20b5942aebdc4553353307776fe32520b4957ffe8274e1c3d00db9f2f5686b05930f488504c7dd5bf864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\8KE1CFYZ\www6.buscaid[1].xml
Filesize
1KB

MD5
977aa5ca8f0f64bc861ee849bf2f592b

SHA1
1aab632e570b1dc9bc24eba4d37ebcd1f778e495

SHA256
ad077847a28b8a3a18e5d981d1648a5bb1c21cc97a4d1f3cf5c48b60383e20d9

SHA512
5eca880273875f21cd73ec9bb455b090c9b21ba3100bb359f4ee3203dd64dcc1941be73348e0341bf5564c7e01f15f2a295c780678e77e413f8c758156a6c602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\40RIWK2F.htm
Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\GONYEMPD.htm
Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\LHYIEHSR.htm
Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\58HYYQQL.htm
Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\95ONO07I.htm
Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\T8AOP9IL.htm
Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
memory/1440-163-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1440-159-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1440-162-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1440-158-0x0000000000000000-mapping.dmp

Download
memory/1440-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1440-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3444-134-0x0000000000BF0000-0x0000000000C2C000-memory.dmp

Filesize
240KB

Download
memory/3444-133-0x0000000000000000-mapping.dmp

Download
memory/3548-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-135-0x0000000000000000-mapping.dmp

Download
memory/3548-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4364-132-0x0000000000000000-mapping.dmp

Download
memory/4676-138-0x0000000000BF0000-0x0000000000C2C000-memory.dmp

Filesize
240KB

Download
memory/4740-144-0x0000000000000000-mapping.dmp

Download
memory/4740-152-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/4744-147-0x0000000000000000-mapping.dmp

Download
memory/5028-166-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/5028-149-0x0000000000000000-mapping.dmp

Download
memory/5028-167-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download