c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

Analysis

max time kernel
152s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe
Size

1.2MB
MD5

c1dcd7f3def2daf60560daa4409a2621
SHA1

feed6679381752d1a9857877a057470c35eba4ea
SHA256

c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb
SHA512

66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84
SSDEEP

3072:OwHl/Gnrl2wGELlyzXq4D2N3v5FQLffCv7oVJNpUpnrT8vp:tB4rlryzIFQLfqvsPfSUv

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 10 IoCs

pid	Process
4524	winlogon.exe
3480	winlogon.exe
3928	winlogon.exe
2212	winlogon.exe
2908	winlogon.exe
3404	winlogon.exe
448	winlogon.exe
2504	winlogon.exe
4152	winlogon.exe
3920	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSYNC.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamstats.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efinet32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamstats.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepsrv.sys.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERPNT.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfw2en.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pview95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\licmgr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\css1631.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jed.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95_0.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navex15.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\penis32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2624-134-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2696-135-0x0000000000D30000-0x0000000000D6C000-memory.dmp	upx
behavioral2/memory/2624-137-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2624-138-0x0000000000D30000-0x0000000000D6C000-memory.dmp	upx
behavioral2/memory/2624-139-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2624-142-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-144.dat	upx
behavioral2/files/0x0006000000022e5f-145.dat	upx
behavioral2/memory/2624-147-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-150.dat	upx
behavioral2/memory/4524-152-0x0000000000E90000-0x0000000000ECC000-memory.dmp	upx
behavioral2/memory/3928-158-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-159.dat	upx
behavioral2/memory/3928-161-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/3928-162-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/3480-165-0x0000000000E90000-0x0000000000ECC000-memory.dmp	upx
behavioral2/memory/3480-166-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3928-167-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/3480-168-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3928-169-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-170.dat	upx
behavioral2/files/0x0006000000022e5f-174.dat	upx
behavioral2/memory/2212-175-0x0000000000E90000-0x0000000000ECC000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-181.dat	upx
behavioral2/files/0x0006000000022e5f-184.dat	upx
behavioral2/memory/3404-189-0x0000000000E90000-0x0000000000ECC000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-187.dat	upx
behavioral2/files/0x0005000000009db3-194.dat	upx
behavioral2/files/0x0005000000009db3-193.dat	upx
behavioral2/memory/2908-197-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4152-203-0x0000000000ED0000-0x0000000000F0C000-memory.dmp	upx
behavioral2/memory/2504-205-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0005000000009db3-201.dat	upx
behavioral2/memory/3920-209-0x0000000000ED0000-0x0000000000F0C000-memory.dmp	upx
behavioral2/memory/3920-210-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\423434255584152474\	winlogon.exe
File created	C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\423434255584152474\	winlogon.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2696 set thread context of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 4524 set thread context of 3480	4524	winlogon.exe	85
PID 3480 set thread context of 3928	3480	winlogon.exe	86
PID 2212 set thread context of 2908	2212	winlogon.exe	94
PID 3404 set thread context of 2504	3404	winlogon.exe	99
PID 4152 set thread context of 3920	4152	winlogon.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Sound\Beep = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Sound	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://k42u025777wb4ek.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999166"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://43dhte895m5r49b.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://322iv237y50r188.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://561g1ee80823ztd.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d1eb3d7e02d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001699a811012b0f48a94de5f1e16f3f4100000000020000000000106600000001000020000000e101e4fe01077d0c38d60c4d76773053ca12241e26eac1e6644df83598e4210c000000000e8000000002000020000000005f3dde99e1a530e2f3d600ddcdb417c9eda2b21a78c6e59f9e444feb66dea4200000000ff34012ee4138a2aec463e2e15fc877d9f0ddef261169f29cd19e1e28a3a60f40000000d667d858dd7e6f6e5bea2ff6a1ec1533e87ac8b581d158424f2c905ddfb20ac4d4e1a54c980b277e9a0700b6a5c8da8c842a1216995b8c33543067592a041b1f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376331879"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://bwc5u65iu8m4r64.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1013642881"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://z1kwz6d72wcefd7.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a2d2447e02d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://9hq174uju45d590.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001699a811012b0f48a94de5f1e16f3f410000000002000000000010660000000100002000000024ad26282598874e4918f4c6fc093c458ba2e8746574b1b5e0688f3cd7d21ce1000000000e80000000020000200000002893f958756f0d65acd2924d37684d38c1f1c1cc5c764d3a3581b0bf94a78fe62000000065846358d8f645201764517c1126d28a678bfeb647517b78a5b202a47d8ebfb840000000e61a7643ecac72a100d898556a050608d86e0935a0f2379a2f96651d3e72dc2bdb10bb1aec3244ab8f5c1b6156c41c7324416fdb0cfc58603b1694a3edda30c5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999166"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://7kodk3csv30b3ua.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{636BF3AC-6E71-11ED-89AC-E62D9FD3CB0B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1013642881"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://1c4p116n97u9a8e.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://842vpiw28s10h1v.directorio-w.com"	winlogon.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	winlogon.exe
3928	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	3928	winlogon.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5056	iexplore.exe
5056	iexplore.exe
5056	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2624	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe
3480	winlogon.exe
3928	winlogon.exe
2908	winlogon.exe
2504	winlogon.exe
3920	winlogon.exe
5056	iexplore.exe
5056	iexplore.exe
5060	IEXPLORE.EXE
5060	IEXPLORE.EXE
5056	iexplore.exe
5056	iexplore.exe
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
5056	iexplore.exe
5056	iexplore.exe
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE
3928	winlogon.exe
3928	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4088	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	80
PID 2696 wrote to memory of 4088	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	80
PID 2696 wrote to memory of 4088	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	80
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2696 wrote to memory of 2624	2696	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	81
PID 2624 wrote to memory of 4524	2624	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	83
PID 2624 wrote to memory of 4524	2624	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	83
PID 2624 wrote to memory of 4524	2624	c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe	83
PID 4524 wrote to memory of 4696	4524	winlogon.exe	84
PID 4524 wrote to memory of 4696	4524	winlogon.exe	84
PID 4524 wrote to memory of 4696	4524	winlogon.exe	84
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 4524 wrote to memory of 3480	4524	winlogon.exe	85
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 3480 wrote to memory of 3928	3480	winlogon.exe	86
PID 2212 wrote to memory of 4712	2212	winlogon.exe	93
PID 2212 wrote to memory of 4712	2212	winlogon.exe	93
PID 2212 wrote to memory of 4712	2212	winlogon.exe	93
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 2212 wrote to memory of 2908	2212	winlogon.exe	94
PID 3404 wrote to memory of 2480	3404	winlogon.exe	97
PID 3404 wrote to memory of 2480	3404	winlogon.exe	97
PID 3404 wrote to memory of 2480	3404	winlogon.exe	97
PID 3404 wrote to memory of 448	3404	winlogon.exe	98
PID 3404 wrote to memory of 448	3404	winlogon.exe	98
PID 3404 wrote to memory of 448	3404	winlogon.exe	98
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 3404 wrote to memory of 2504	3404	winlogon.exe	99
PID 2908 wrote to memory of 4152	2908	winlogon.exe	100
PID 2908 wrote to memory of 4152	2908	winlogon.exe	100
PID 2908 wrote to memory of 4152	2908	winlogon.exe	100
PID 4152 wrote to memory of 2644	4152	winlogon.exe	101
PID 4152 wrote to memory of 2644	4152	winlogon.exe	101
PID 4152 wrote to memory of 2644	4152	winlogon.exe	101

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe
"C:\Users\Admin\AppData\Local\Temp\c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:3928

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3352

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4804

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe" C:\Windows\system32\WerFault.exe -pss -s 476 -p 444 -ip 444
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4712
- C:\Users\Admin\E696D64614\winlogon.exe
  C:\Windows\system32\WerFault.exe -pss -s 476 -p 444 -ip 444
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe
    "C:\Windows\system32\config\systemprofile\423434255584152474\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      PID:3920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5056 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5056 CREDAT:82952 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5056 CREDAT:17418 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1132

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe" C:\Windows\system32\WerFault.exe -u -p 444 -s 844
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2480
- C:\Users\Admin\E696D64614\winlogon.exe
  C:\Windows\system32\WerFault.exe -u -p 444 -s 844
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Users\Admin\E696D64614\winlogon.exe
  C:\Windows\system32\WerFault.exe -u -p 444 -s 844
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9

Filesize
1KB

MD5
9a1abbce3ae069f45cbe33e04342094b

SHA1
a3a98f4b4142ff83bbbd0364e6e09f64854919dd

SHA256
3708a3d7064f8a697d7df4aa573b046fc0c6aed04ed01f3666f7941afde18773

SHA512
4e3bd4ad8fa4b82655411fd2c952b35e32a29a82853ac9c5474787f9f9e8dd9b670149b0c323bc3eaa093752bac373e1e42f76f155a971bfed99f5c1ee40a414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
eb8c9fbef4633868dffc517c34fbeace

SHA1
2e5a63b5e1d0f3224960a7fa9391bb67fc236d04

SHA256
be67cef9cd7227c55c2f6393ee7f0c9aacc7a9fd551581c015c526bef95631b5

SHA512
e1abff3608fa60a08114e8c7f72f31aa0a435d0a6b29792734b5bcf26a1f338235490363859b0e9f8784101dd8a05a583b798b2c191f0fc8aeef2df75bd18942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
db0592962d9de77cd824619c4d96005c

SHA1
3e3640d22b532ab4627c310ba06786ca8249f371

SHA256
86188f175288d2c920c91395154ea7a04c77ae08784789e18174e2a7598013d9

SHA512
a202fc3b59d024079e74e54abfc606c821eb4699a9c8aae3f3b11da166b7abc68f140d47a74525962b02fd3c9647fcbc927c53fc962f36065438e771f8ea380d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d01f6845062b8f1cb3ef9fb108c16755

SHA1
0743777e9ebf074330b32dba956a8fbaf1dc4a9a

SHA256
bf61698a982c8c89bfb36fe0d63ce8890de405af4f30ff2c017f3190d48e9a06

SHA512
3b81b9062ea3c2f0240cbc60f800c0aaf495a053385b1b086436c2859cfc622384f60aad9ec287ac93b11fda461246882d3c282dc88be6c474def823a4d6e521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
9f6cc8d3fe9092a6d3901e873a87fd87

SHA1
2e0aac117a4cc57596efb3d6f6624c269f94b031

SHA256
e73982e62b92abac3d15b161f4525448cc2bc8b9bacefdcbfc6f87b74ec372e4

SHA512
9736a099967d7ad595439768e45c633ff7d34de92f7cb0c19cd3d4590c4a6dd4fedfcd1b5617c81652e61f4ffe919057507f622f4c6d8d626cfc40234ad2c757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
993614098803429208a7beacf874b277

SHA1
4aac1b194d1d0523224804e1a415e18248bd6ae6

SHA256
4658f2ba3c631a0203558b3feab08757b6bd7f66acec8f10c3e02982b006f6ce

SHA512
48b20b42a4069641ecd45c1ccef9275110a0db02e5d306434611b57e4e72266a7e8f841e61bea1ed96af3c67b917fc23f45a9946212a99291a728d5e0973feb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
2729b3dc45f5c3549781096d2f953abf

SHA1
db954efe7c9e9948d579a44efbcad78a8720dffd

SHA256
12a0607343d847606b3fac170a80c5f64ce70457e1a54fe6a245411b6ddc8593

SHA512
108b6a338f4043cfef8da285c7135924b20edef5d9740bac2e7396775b0abf81339c95da9400042486afea6bbf39c0455f2b3ddcc65f7ab050e4988ff45ecba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0684275E946EA5A526A0B9446D8D1B31_8BC55A34553CE38DA9A256FD39734BE9

Filesize
458B

MD5
e2054579b42dd61396562e4af89bc95c

SHA1
e4557b05af2b699f3ba838168b0a7edefff44219

SHA256
ff6596568fbac339a3f7ff09425d27af5ce681ef6fe0aa085bfb080712a7eeaf

SHA512
ed3b821db45538296e5ef35537dd3f91b9a3973b8b1be02872dab48fa2e16cce59bfd99eb3faa9638441187164a3c8b483f49631a30038da4380de92771a8d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
35e8aa7fd1668211e1ac31d5436fc64c

SHA1
5920e88d61530e2ccbe711c74ba80b0e00153eb0

SHA256
d4f15efe54eb5cc519472a956f2c38a1be8b013fe5a6282fd42ce3b00d5e6126

SHA512
71d73f79bb060bee76b99d43a1350c9501aa7f6637dd68db9989275715d5c85027c005c5fbf902838f6b698fcce67fa67b7c12dcd49be0a16e05d20d5477791a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
c2f00f1c3214f23ff5f966ec7ece3eee

SHA1
be5fb7d57544f74439c574af1ee30b116627ee87

SHA256
b65aba4612b9c6c8b843042e3640f968718c9d0b9f8eca02d7bed3c3cccb061d

SHA512
4ac504868346143973f6617f7624fa60ca77125b74b0c6bdc8171d19cd1dc03155b2467224585d78a19079bbe1fd3e410453d6f6ba8b28debbf9e5d839ba4581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
d0c811cdb84da8fac0e26ecc2b855c03

SHA1
e610a760cd930d16d67542ddc2591136e9ef6c7a

SHA256
7e4a47f7ddf0bb6d8dfc2b1ea0ba3bbb691fa40f7a97f09dc39fe2168d217f7e

SHA512
aaeecea4ecb6ea8bd3467310edc472d8da1918ff4b7557d18c36f7eef87483e6f45efa2d2372b124e2e4b23de6e4f924be1032bdfef81b8cbe0ede56b78e8e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
8b5a6bd2912848fabb5468062a9a59f3

SHA1
a3cf350fabef64997a512846bec443b5826cf21d

SHA256
559648d061f6e9f84a752c2f14311c9568555c2d6931d1a2f90e50b6b279f5f9

SHA512
5a13e880e5f2be78c3be8d3d897f812b0892345e183e587373c2570ad9f25259827813911469e4aa13430f4cc3b67900bee6f7813f8f6e01bd8ec1ae6475654c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
15406f4b8c6dceb68ab12fbb164f9e60

SHA1
3cc47ea9f352c612161d39c744b0343644f4b06d

SHA256
c8a6488df8437816921ae730b01c4e3478e100f89980922f8a7940123ee68045

SHA512
0ec6f76e1f6c359f64c4a36b3fc6b54c37484f081bed88a0638cc2a459d69ea6f70f87a6f42241e66ae5ff8497688b236b8fc672f5bb6713c62df847d91030a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
44918d89de0598c9c1b296e4aa576e91

SHA1
f76b16a2cc826ad751a91c8f2ec43e3b4b8be642

SHA256
4a7fe875b6de35a85f88971af21b56cf1f34a15cc1954624d9d58530b25db155

SHA512
d6edb2ae2449276e3595b38e476b47cdeb0b24415cda591cfb88e880fb7c922a50a7b93d49305691b4334a6dacd4d9546f14ee1409746622e6dfb62dbd5eb941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
2c937726505d2fc280c355465fbfe118

SHA1
d7f09ccfb6bbab55a3abd0f913de4b837d2f7ebc

SHA256
d473bbb920a58e1e6aa411bd529f5049c65f86c43325bb8da21d0adf11f05623

SHA512
7fd26ad42c8076a34ba017be03961af96a512e9964efbc42063de80373a96ddcc61194adbf0cfdc9005c32be527e10d92b5e76231ea31ce12d253b30f6191796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
d646fb44fab07a8a1c62dd5224dc5bbc

SHA1
fea84eaca00db1ea42e01ea1c8916e4768740546

SHA256
176c1479e5e0291c94dc8758307bdce9f608f7cff804336ba0cba3b3a1489ad9

SHA512
41e02257a35a3fc6a1b35f26646700449f8d35223956493999163104a720ab943912f2b6b9f8c0881222914666907d79624e01a68b500b90c46f38a5e4cec080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TYN3SDYV\www6.buscaid[1].xml

Filesize
1KB

MD5
dad198c36a1e4774bc3c202d90564258

SHA1
c9c5cb345aff685a95e4391539ecb9e3b2abc14f

SHA256
e7891d5e3849f98396c274f79a04f068144a1e68f2cad8dd39250552c41c94d2

SHA512
6ce8cac80db1a1c533dc5ada2ea854bf5ce5aa0282c35376a898d3d39efc840c816539aeca58e2e5dfe19599abea2b7aa294d7164f6d38e1be674b8e518029cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\XEHFZGO5.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\caf[1].js

Filesize
143KB

MD5
6a4a096cfd45d6e91ffb1265f27e27c5

SHA1
075eb68b0b85f5ddf30882ea0e765a59a3e157aa

SHA256
5d2dadd156f02d2b9b305f0b3e9a2a1d28c32bee19f5d44e107902e4b8727ced

SHA512
1726d0b6d478491944cf9613d91b321ddf7919df83a63eaea503b06e1af1b2c475e6a3b12183e714e89242c73908e042d121bedc0e5abcde71b8e02f40dd0aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\2FE1VB5M.htm

Filesize
2KB

MD5
41f66bb0ac50f2d851236170e7c71341

SHA1
59bcec216302151922219b51be8ad8ab6d0b8384

SHA256
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

SHA512
d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\v4[1].xml

Filesize
9KB

MD5
572dec3502ab5cfe04d88a79c9c7c096

SHA1
cf2b18cb0435be24560db694232fd28139ee70fd

SHA256
982903dadee1a426f73e830bd4242e73f70ba145d4168a7f26a4a7bdddad6a90

SHA512
5ede23a6671d080aa289170e55f19dc471df449ae8baed2c85ef7b6611a2892bc9299f6f3be64f2d13ec18352c1291a5cb0f0951bbf470ff3e5480c504970c36

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
C:\Windows\SysWOW64\config\systemprofile\423434255584152474\winlogon.exe

Filesize
1.2MB

MD5
c1dcd7f3def2daf60560daa4409a2621

SHA1
feed6679381752d1a9857877a057470c35eba4ea

SHA256
c270160d8254b84bd6764c519dab824090f54cd29c69fa68f097f20278f846cb

SHA512
66eaa2fa4bf3271584bb8ee22d1f04ca0c1653b0b3d42f922f1fcebdca2614879f8294e8d42083fc857c7ea7284a129f5049bd4f66a242ce5979b28770fd7f84

Download Submit
memory/2212-175-0x0000000000E90000-0x0000000000ECC000-memory.dmp

Filesize
240KB

Download
memory/2504-205-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2624-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2624-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2624-138-0x0000000000D30000-0x0000000000D6C000-memory.dmp

Filesize
240KB

Download
memory/2624-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2624-142-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2624-147-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2696-135-0x0000000000D30000-0x0000000000D6C000-memory.dmp

Filesize
240KB

Download
memory/2908-197-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3404-189-0x0000000000E90000-0x0000000000ECC000-memory.dmp

Filesize
240KB

Download
memory/3480-166-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3480-168-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3480-165-0x0000000000E90000-0x0000000000ECC000-memory.dmp

Filesize
240KB

Download
memory/3920-209-0x0000000000ED0000-0x0000000000F0C000-memory.dmp

Filesize
240KB

Download
memory/3920-210-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3928-161-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3928-158-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3928-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3928-167-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3928-162-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4152-203-0x0000000000ED0000-0x0000000000F0C000-memory.dmp

Filesize
240KB

Download
memory/4524-152-0x0000000000E90000-0x0000000000ECC000-memory.dmp

Filesize
240KB

Download