b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c

Analysis

max time kernel
151s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Size

91KB
MD5

7cc90346dbba998af267ffe391130d8f
SHA1

c0269f05ec53dc34c887a989b5917956e200d364
SHA256

b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c
SHA512

05e01f919ed3f4a809440b152f44fdcdd50ebc1964f38ae15782e834953f0b430a201be14cce21d80a59cb3b1e2b9234c9398d24c43be4428efd14cb9bc395e2
SSDEEP

1536:ipDnq+5h/tDSZ15Wwd72pDnq+5h/tDSZ15WwdO:ipDRzSZaCCpDRzSZaCO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	babon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	babon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	babon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	babon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 30 IoCs

pid	Process
268	babon.exe
1972	IExplorer.exe
1152	winlogon.exe
1516	csrss.exe
616	lsass.exe
1532	babon.exe
1888	babon.exe
1012	babon.exe
680	IExplorer.exe
1668	IExplorer.exe
1436	winlogon.exe
1456	babon.exe
1644	IExplorer.exe
1612	babon.exe
828	winlogon.exe
1464	IExplorer.exe
1180	csrss.exe
1592	csrss.exe
588	winlogon.exe
328	IExplorer.exe
632	lsass.exe
1200	lsass.exe
1068	winlogon.exe
1104	csrss.exe
1912	winlogon.exe
1996	csrss.exe
1092	lsass.exe
1620	lsass.exe
1888	csrss.exe
1532	lsass.exe

Loads dropped DLL 45 IoCs

pid	Process
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
1152	winlogon.exe
1152	winlogon.exe
1972	IExplorer.exe
1972	IExplorer.exe
1972	IExplorer.exe
1972	IExplorer.exe
1516	csrss.exe
1516	csrss.exe
1152	winlogon.exe
268	babon.exe
268	babon.exe
1152	winlogon.exe
1152	winlogon.exe
1516	csrss.exe
1972	IExplorer.exe
1972	IExplorer.exe
1516	csrss.exe
616	lsass.exe
616	lsass.exe
1152	winlogon.exe
1152	winlogon.exe
268	babon.exe
268	babon.exe
1972	IExplorer.exe
1972	IExplorer.exe
268	babon.exe
268	babon.exe
616	lsass.exe
616	lsass.exe
616	lsass.exe
616	lsass.exe
616	lsass.exe
268	babon.exe
268	babon.exe
1516	csrss.exe
1516	csrss.exe
1516	csrss.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	winlogon.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\U:	lsass.exe
File opened (read-only)	\??\I:	babon.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\M:	lsass.exe
File opened (read-only)	\??\E:	lsass.exe
File opened (read-only)	\??\K:	lsass.exe
File opened (read-only)	\??\L:	lsass.exe
File opened (read-only)	\??\T:	lsass.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\F:	csrss.exe
File opened (read-only)	\??\E:	winlogon.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\W:	lsass.exe
File opened (read-only)	\??\K:	babon.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\F:	babon.exe
File opened (read-only)	\??\W:	babon.exe
File opened (read-only)	\??\Z:	babon.exe
File opened (read-only)	\??\N:	csrss.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\B:	lsass.exe
File opened (read-only)	\??\G:	lsass.exe
File opened (read-only)	\??\P:	lsass.exe
File opened (read-only)	\??\X:	lsass.exe
File opened (read-only)	\??\B:	csrss.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\Y:	babon.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\U:	IExplorer.exe
File opened (read-only)	\??\V:	babon.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\R:	lsass.exe
File opened (read-only)	\??\L:	babon.exe
File opened (read-only)	\??\M:	babon.exe
File opened (read-only)	\??\U:	babon.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\Q:	lsass.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\Z:	lsass.exe
File opened (read-only)	\??\H:	babon.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\I:	lsass.exe
File opened (read-only)	\??\E:	babon.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\O:	babon.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	winlogon.exe
File opened for modification	C:\autorun.inf	winlogon.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\babon.scr	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	babon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	lsass.exe
File created	C:\Windows\SysWOW64\shell.exe	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	babon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	babon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	babon.exe
File created	C:\Windows\SysWOW64\babon.scr	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\babon.exe	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\babon.exe	IExplorer.exe
File opened for modification	C:\Windows\babon.exe	winlogon.exe
File created	C:\Windows\babon.exe	winlogon.exe
File opened for modification	C:\Windows\babon.exe	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
File created	C:\Windows\babon.exe	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\babon.exe	lsass.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\babon.exe	IExplorer.exe
File opened for modification	C:\Windows\babon.exe	babon.exe
File created	C:\Windows\babon.exe	babon.exe
File opened for modification	C:\Windows\babon.exe	csrss.exe
File created	C:\Windows\babon.exe	lsass.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 42 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Babon"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Babon"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Babon"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Babon"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Babon"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Babon"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Babon"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Babon"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Babon"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Babon"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s2359 = "Babon"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\s1159 = "Babon"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	csrss.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	IExplorer.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
268	babon.exe
1152	winlogon.exe
1516	csrss.exe
1972	IExplorer.exe
616	lsass.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
268	babon.exe
1972	IExplorer.exe
1152	winlogon.exe
1516	csrss.exe
616	lsass.exe
1888	babon.exe
1532	babon.exe
1012	babon.exe
1668	IExplorer.exe
680	IExplorer.exe
1436	winlogon.exe
1456	babon.exe
828	winlogon.exe
1644	IExplorer.exe
1612	babon.exe
1180	csrss.exe
1464	IExplorer.exe
1592	csrss.exe
328	IExplorer.exe
632	lsass.exe
1068	winlogon.exe
1200	lsass.exe
1912	winlogon.exe
1104	csrss.exe
1996	csrss.exe
1092	lsass.exe
1620	lsass.exe
1888	csrss.exe
1532	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 268	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	27
PID 1200 wrote to memory of 268	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	27
PID 1200 wrote to memory of 268	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	27
PID 1200 wrote to memory of 268	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	27
PID 1200 wrote to memory of 1972	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	28
PID 1200 wrote to memory of 1972	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	28
PID 1200 wrote to memory of 1972	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	28
PID 1200 wrote to memory of 1972	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	28
PID 1200 wrote to memory of 1152	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	29
PID 1200 wrote to memory of 1152	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	29
PID 1200 wrote to memory of 1152	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	29
PID 1200 wrote to memory of 1152	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	29
PID 1200 wrote to memory of 1516	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	30
PID 1200 wrote to memory of 1516	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	30
PID 1200 wrote to memory of 1516	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	30
PID 1200 wrote to memory of 1516	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	30
PID 1200 wrote to memory of 616	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	31
PID 1200 wrote to memory of 616	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	31
PID 1200 wrote to memory of 616	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	31
PID 1200 wrote to memory of 616	1200	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe	31
PID 1972 wrote to memory of 1532	1972	IExplorer.exe	32
PID 1972 wrote to memory of 1532	1972	IExplorer.exe	32
PID 1972 wrote to memory of 1532	1972	IExplorer.exe	32
PID 1972 wrote to memory of 1532	1972	IExplorer.exe	32
PID 1152 wrote to memory of 1888	1152	winlogon.exe	33
PID 1152 wrote to memory of 1888	1152	winlogon.exe	33
PID 1152 wrote to memory of 1888	1152	winlogon.exe	33
PID 1152 wrote to memory of 1888	1152	winlogon.exe	33
PID 1516 wrote to memory of 1012	1516	csrss.exe	34
PID 1516 wrote to memory of 1012	1516	csrss.exe	34
PID 1516 wrote to memory of 1012	1516	csrss.exe	34
PID 1516 wrote to memory of 1012	1516	csrss.exe	34
PID 1152 wrote to memory of 680	1152	winlogon.exe	42
PID 1152 wrote to memory of 680	1152	winlogon.exe	42
PID 1152 wrote to memory of 680	1152	winlogon.exe	42
PID 1152 wrote to memory of 680	1152	winlogon.exe	42
PID 1972 wrote to memory of 1668	1972	IExplorer.exe	40
PID 1972 wrote to memory of 1668	1972	IExplorer.exe	40
PID 1972 wrote to memory of 1668	1972	IExplorer.exe	40
PID 1972 wrote to memory of 1668	1972	IExplorer.exe	40
PID 1972 wrote to memory of 1436	1972	IExplorer.exe	39
PID 1972 wrote to memory of 1436	1972	IExplorer.exe	39
PID 1972 wrote to memory of 1436	1972	IExplorer.exe	39
PID 1972 wrote to memory of 1436	1972	IExplorer.exe	39
PID 268 wrote to memory of 1456	268	babon.exe	38
PID 268 wrote to memory of 1456	268	babon.exe	38
PID 268 wrote to memory of 1456	268	babon.exe	38
PID 268 wrote to memory of 1456	268	babon.exe	38
PID 1516 wrote to memory of 1644	1516	csrss.exe	37
PID 1516 wrote to memory of 1644	1516	csrss.exe	37
PID 1516 wrote to memory of 1644	1516	csrss.exe	37
PID 1516 wrote to memory of 1644	1516	csrss.exe	37
PID 616 wrote to memory of 1612	616	lsass.exe	35
PID 616 wrote to memory of 1612	616	lsass.exe	35
PID 616 wrote to memory of 1612	616	lsass.exe	35
PID 616 wrote to memory of 1612	616	lsass.exe	35
PID 1152 wrote to memory of 828	1152	winlogon.exe	36
PID 1152 wrote to memory of 828	1152	winlogon.exe	36
PID 1152 wrote to memory of 828	1152	winlogon.exe	36
PID 1152 wrote to memory of 828	1152	winlogon.exe	36
PID 268 wrote to memory of 1464	268	babon.exe	41
PID 268 wrote to memory of 1464	268	babon.exe	41
PID 268 wrote to memory of 1464	268	babon.exe	41
PID 268 wrote to memory of 1464	268	babon.exe	41

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	babon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe

C:\Users\Admin\AppData\Local\Temp\b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe
"C:\Users\Admin\AppData\Local\Temp\b3c7a0b464870daac1383887aeb46fa254d4e84b8ce49eeca92c35de71f9910c.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1200
- C:\Windows\babon.exe
  C:\Windows\babon.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:268
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1464
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1068
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1972
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1436
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1668
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1200
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1152
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1888
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:828
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:680
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1180
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:632
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1516
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1644
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    PID:588
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1888
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:616
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:328
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1996
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\csrss.exe

Filesize
91KB

MD5
d33c9a65155e13eef3aa5be588c59458

SHA1
089358220be514301bdfb980ac2a3edaeb24f8bb

SHA256
e5c2653b08e028a44824acbedc5a9aff1a50b8ead012d719f96e5a3cb9d43f18

SHA512
1607e727eb76451e05313d8546ff2ce63b9aaca2d7e2ef15c698cc0ba3de96539bf17b05019296c084c02d02fb011def0c9d0e473b950cc37da9de2c62846ad5

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
91KB

MD5
3cd38b7fdef1460d909ff1b879c7c88e

SHA1
b8a69ac84d9c33d3e76e2a8469b42c6ea57b8129

SHA256
05f49aceee53612ee97d1a4cad99627bb3957870f6c5f617e0e75b3e9e57f460

SHA512
7d86bd224ed0180770f1696e29e6fa564f344717c20e38971056fcf51b276dcabb3c7058722c065e8aeb5adf45039088bec8062265e8a41253d3c9d8823d5374

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe

Filesize
91KB

MD5
d33c9a65155e13eef3aa5be588c59458

SHA1
089358220be514301bdfb980ac2a3edaeb24f8bb

SHA256
e5c2653b08e028a44824acbedc5a9aff1a50b8ead012d719f96e5a3cb9d43f18

SHA512
1607e727eb76451e05313d8546ff2ce63b9aaca2d7e2ef15c698cc0ba3de96539bf17b05019296c084c02d02fb011def0c9d0e473b950cc37da9de2c62846ad5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
91KB

MD5
f14b492fa55027e41c37abfbf019a1f4

SHA1
6747b1de8b2980a44807fa1ec9ef4bb5a55faba6

SHA256
188ff4188e6e128268dd12f427c6644a840ae70f75fe308f1002fe37d8de5162

SHA512
c8b579df39f0e0a987481525f9b839185e17e9d68fa557bd9d8d937e029fc001608272de2941cfc4241e15a37bc7f1626294dc1760baedcbeede93e350529b09

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
91KB

MD5
f14b492fa55027e41c37abfbf019a1f4

SHA1
6747b1de8b2980a44807fa1ec9ef4bb5a55faba6

SHA256
188ff4188e6e128268dd12f427c6644a840ae70f75fe308f1002fe37d8de5162

SHA512
c8b579df39f0e0a987481525f9b839185e17e9d68fa557bd9d8d937e029fc001608272de2941cfc4241e15a37bc7f1626294dc1760baedcbeede93e350529b09

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
91KB

MD5
c9283c8afa469485665e2fa562916001

SHA1
88735202c148c6138518e1121a83326dfbbbeff1

SHA256
998156f33e6d88b41c5ebed40ef8e7b9dca7e21bb5b82b83b1531378c8b3dfe4

SHA512
4ef8356a3be917c0c01ac58227748934afeb002db5ec4a941a2a5bcdb13fbfe5cebd73acafe9ed2bf354803c58b12af428cac89e1491156b0907f7e126a61326

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
91KB

MD5
3cd38b7fdef1460d909ff1b879c7c88e

SHA1
b8a69ac84d9c33d3e76e2a8469b42c6ea57b8129

SHA256
05f49aceee53612ee97d1a4cad99627bb3957870f6c5f617e0e75b3e9e57f460

SHA512
7d86bd224ed0180770f1696e29e6fa564f344717c20e38971056fcf51b276dcabb3c7058722c065e8aeb5adf45039088bec8062265e8a41253d3c9d8823d5374

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
91KB

MD5
d4e44199c7294c1b730549a1771e5b55

SHA1
cbbb181ed26041df0739be7a7d27107a080cf948

SHA256
fe8681889c10bab78a706e798622bae51b8489d9fa5820e3cf17b6ea09b10f0f

SHA512
223dc0c77f1b0c91dd937798a6cb048e7a56e328c0deb00476a21d8f260644c76acead656054005ebf336eb7248772dbae37293c6b98d17b1dd1fab531a83988

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
91KB

MD5
d4e44199c7294c1b730549a1771e5b55

SHA1
cbbb181ed26041df0739be7a7d27107a080cf948

SHA256
fe8681889c10bab78a706e798622bae51b8489d9fa5820e3cf17b6ea09b10f0f

SHA512
223dc0c77f1b0c91dd937798a6cb048e7a56e328c0deb00476a21d8f260644c76acead656054005ebf336eb7248772dbae37293c6b98d17b1dd1fab531a83988

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
64KB

MD5
6b17c1f5e855417e934f695b299d0e70

SHA1
cc03b0277fd4f222a2130dd61b1468fee9d25d31

SHA256
e52ec1bc53a58cb9d212123479c1f89b8b2d9159fd28bc867f814d9a765b345c

SHA512
999999cbfa5b5a644dbaf67b0277290904a2e5b49d90cc33573460ddd3854a2c36041dd6ba802c51efa166fcc8646ef354c04883fe175fcf6fa5851fbbe5ce12

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
64KB

MD5
993c81bd23bf8b33d4d945e8d1d4b009

SHA1
5400c0c1104c3ba82783982142e1c765a5ce8f01

SHA256
ee1c4beda200c9f8aafc445cdd4f2ddae7d739566a93a075f8f8553b463c8387

SHA512
f3ba95b1ffeb4d4b66cee6257aaabd89d55ef428801853b6700ee218215b723533aad8674841cdb54b0c29b694b4c3337a4c3c1ce18752512dee750574e42a54

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
64KB

MD5
993c81bd23bf8b33d4d945e8d1d4b009

SHA1
5400c0c1104c3ba82783982142e1c765a5ce8f01

SHA256
ee1c4beda200c9f8aafc445cdd4f2ddae7d739566a93a075f8f8553b463c8387

SHA512
f3ba95b1ffeb4d4b66cee6257aaabd89d55ef428801853b6700ee218215b723533aad8674841cdb54b0c29b694b4c3337a4c3c1ce18752512dee750574e42a54

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
91KB

MD5
90cbdb86a97c6516a1304ba03b550d80

SHA1
45db3c3954b37163df735162e88696b49ddf49f7

SHA256
a7e0f559db8f650cb84150a3f450d9a3d416d4c14b455e7f32ba5a1e4980a0bd

SHA512
5856261a294f6e756c90f5c4789311aeb2262d26e60bdd61cee48bf0175c97e078ef6314458a7853a88ec3400d98fb7aed592afbfdd9f80b5ca7ecb60e64fadd

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
ee4296d20f9e14fa35854c0ab724732c

SHA1
5138ffddfe26cc22daa72d9ea7ab87c2a9ff3635

SHA256
244e6b6096a7094c0729b51df742ea5c0eff39343cc46e8ffd58825be1b72a1f

SHA512
1d9442c3984c94dc0edf219119d27a4ba6cd02665cf0047087131ac7a356ed2fa37dcce53634378bb5ffa66a6c009c402b3e617b81daf01cfebb7cd1adfea995

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
ee4296d20f9e14fa35854c0ab724732c

SHA1
5138ffddfe26cc22daa72d9ea7ab87c2a9ff3635

SHA256
244e6b6096a7094c0729b51df742ea5c0eff39343cc46e8ffd58825be1b72a1f

SHA512
1d9442c3984c94dc0edf219119d27a4ba6cd02665cf0047087131ac7a356ed2fa37dcce53634378bb5ffa66a6c009c402b3e617b81daf01cfebb7cd1adfea995

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
ee4296d20f9e14fa35854c0ab724732c

SHA1
5138ffddfe26cc22daa72d9ea7ab87c2a9ff3635

SHA256
244e6b6096a7094c0729b51df742ea5c0eff39343cc46e8ffd58825be1b72a1f

SHA512
1d9442c3984c94dc0edf219119d27a4ba6cd02665cf0047087131ac7a356ed2fa37dcce53634378bb5ffa66a6c009c402b3e617b81daf01cfebb7cd1adfea995

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
d33c9a65155e13eef3aa5be588c59458

SHA1
089358220be514301bdfb980ac2a3edaeb24f8bb

SHA256
e5c2653b08e028a44824acbedc5a9aff1a50b8ead012d719f96e5a3cb9d43f18

SHA512
1607e727eb76451e05313d8546ff2ce63b9aaca2d7e2ef15c698cc0ba3de96539bf17b05019296c084c02d02fb011def0c9d0e473b950cc37da9de2c62846ad5

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
b3fa57b98fa0e7217b047be203ebe9f4

SHA1
d48f005d31b65da01ef1546eaafc1444de761914

SHA256
3764e8fbf7f6f222389b73cf3067cce4ece10944462bcbc005f11cbe5a96be7b

SHA512
c88aa095e77bc9ba677b5dfc76a693cdac636fb75d9dd475c64dc1e085d683940a19a8a5f0a98a3d6d46ec5a63ff90b92eed08eb044f57cfec509be7bb86acc5

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
b3fa57b98fa0e7217b047be203ebe9f4

SHA1
d48f005d31b65da01ef1546eaafc1444de761914

SHA256
3764e8fbf7f6f222389b73cf3067cce4ece10944462bcbc005f11cbe5a96be7b

SHA512
c88aa095e77bc9ba677b5dfc76a693cdac636fb75d9dd475c64dc1e085d683940a19a8a5f0a98a3d6d46ec5a63ff90b92eed08eb044f57cfec509be7bb86acc5

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
25dd3703186f8c7e6bfd044cfa6b647d

SHA1
9d2b6b205b78eb84bfadd051cde1c97317c5972a

SHA256
751f229855a44369ef424660f246d620918e5272e925c4aac283a62a544b69cf

SHA512
68fc2952244c11a262f68e7746f31e6e874b8f629cc5680ef5ee5cf0ee2e3ce4a8f1e83f1d51363c609f5ba309087ead2587bda2e810e930538a02bcf83cbc29

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
25dd3703186f8c7e6bfd044cfa6b647d

SHA1
9d2b6b205b78eb84bfadd051cde1c97317c5972a

SHA256
751f229855a44369ef424660f246d620918e5272e925c4aac283a62a544b69cf

SHA512
68fc2952244c11a262f68e7746f31e6e874b8f629cc5680ef5ee5cf0ee2e3ce4a8f1e83f1d51363c609f5ba309087ead2587bda2e810e930538a02bcf83cbc29

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
25dd3703186f8c7e6bfd044cfa6b647d

SHA1
9d2b6b205b78eb84bfadd051cde1c97317c5972a

SHA256
751f229855a44369ef424660f246d620918e5272e925c4aac283a62a544b69cf

SHA512
68fc2952244c11a262f68e7746f31e6e874b8f629cc5680ef5ee5cf0ee2e3ce4a8f1e83f1d51363c609f5ba309087ead2587bda2e810e930538a02bcf83cbc29

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
25dd3703186f8c7e6bfd044cfa6b647d

SHA1
9d2b6b205b78eb84bfadd051cde1c97317c5972a

SHA256
751f229855a44369ef424660f246d620918e5272e925c4aac283a62a544b69cf

SHA512
68fc2952244c11a262f68e7746f31e6e874b8f629cc5680ef5ee5cf0ee2e3ce4a8f1e83f1d51363c609f5ba309087ead2587bda2e810e930538a02bcf83cbc29

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
b6c5063285ae341ecb2a53e6e2f1bae7

SHA1
19f129b07bc448611708b314b603d713a501a0ae

SHA256
f42e717ee4a0459ebd856b710a312781259a546a020a97282823e6a9214958a5

SHA512
cfff564097b642260e300374f3273dab722c740c3b8552f7b9835a53a30c99217ce596308bf078f6c3049b07a2e584060dc9c177a5ce04acc6f49dc89d70e66b

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
C:\Windows\babon.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\Windows\babon.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\Windows\babon.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\Windows\babon.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\Windows\babon.exe

Filesize
91KB

MD5
39d0183ceb0186260d489aa8e8abe25f

SHA1
1daa35550b03a11181c40a6927a66bf3cb5e5519

SHA256
b4a971da6af9cc160ef4fe7c73446af2ac08795876650c2b2836117d457e21ef

SHA512
08618269ab17d21b327433bd1d14da4a6b568e537534cd3e505bec8eb21a0ddd77320ea75b9a78e2a6a606de4254ad80b5a482515a9ad3f4354d3724d0671df4

Download Submit
C:\babon.exe

Filesize
91KB

MD5
f8a0e669f253c751dd53b2730c70f48b

SHA1
107c0ce210c986970eb0cd6268a1e54e4929aba7

SHA256
edfc500f2e7408c3155e8c87b52c286975fa051082b1020cd3c7afd34224c69e

SHA512
6d4f38fbbecb9cfb2d933ae5f7948fa8ed469098afc9fe926541c0a862724009a4167e60f724b73678ef4cb99f93a7b9b9e64729e876d5b0fe87c1ef7cc5b5ff

Download Submit
C:\babon.exe

Filesize
91KB

MD5
f8a0e669f253c751dd53b2730c70f48b

SHA1
107c0ce210c986970eb0cd6268a1e54e4929aba7

SHA256
edfc500f2e7408c3155e8c87b52c286975fa051082b1020cd3c7afd34224c69e

SHA512
6d4f38fbbecb9cfb2d933ae5f7948fa8ed469098afc9fe926541c0a862724009a4167e60f724b73678ef4cb99f93a7b9b9e64729e876d5b0fe87c1ef7cc5b5ff

Download Submit
C:\babon.exe

Filesize
91KB

MD5
f8a0e669f253c751dd53b2730c70f48b

SHA1
107c0ce210c986970eb0cd6268a1e54e4929aba7

SHA256
edfc500f2e7408c3155e8c87b52c286975fa051082b1020cd3c7afd34224c69e

SHA512
6d4f38fbbecb9cfb2d933ae5f7948fa8ed469098afc9fe926541c0a862724009a4167e60f724b73678ef4cb99f93a7b9b9e64729e876d5b0fe87c1ef7cc5b5ff

Download Submit
C:\babon.exe

Filesize
91KB

MD5
f8a0e669f253c751dd53b2730c70f48b

SHA1
107c0ce210c986970eb0cd6268a1e54e4929aba7

SHA256
edfc500f2e7408c3155e8c87b52c286975fa051082b1020cd3c7afd34224c69e

SHA512
6d4f38fbbecb9cfb2d933ae5f7948fa8ed469098afc9fe926541c0a862724009a4167e60f724b73678ef4cb99f93a7b9b9e64729e876d5b0fe87c1ef7cc5b5ff

Download Submit
C:\babon.exe

Filesize
91KB

MD5
7d22815f4773ca619792f1db5e56893c

SHA1
8fa0f8bbdc4472651797e8d065005bb61fc29ead

SHA256
77ff6ada050f83264f08f278dfa6624f441703aa0b57f7273400eca7a878f960

SHA512
56971492c0f69d4feb847bb323826a6385ef17403239282b8a5bdd27179a28a938b2531138d556d12030c7566767a215aeaaeb885f612fb0b6d6afa2161be663

Download Submit
C:\babon.exe

Filesize
91KB

MD5
7d22815f4773ca619792f1db5e56893c

SHA1
8fa0f8bbdc4472651797e8d065005bb61fc29ead

SHA256
77ff6ada050f83264f08f278dfa6624f441703aa0b57f7273400eca7a878f960

SHA512
56971492c0f69d4feb847bb323826a6385ef17403239282b8a5bdd27179a28a938b2531138d556d12030c7566767a215aeaaeb885f612fb0b6d6afa2161be663

Download Submit
C:\babon.exe

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
C:\babon.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
\Users\Admin\AppData\Local\WINDOWS\csrss.exe

Filesize
91KB

MD5
d33c9a65155e13eef3aa5be588c59458

SHA1
089358220be514301bdfb980ac2a3edaeb24f8bb

SHA256
e5c2653b08e028a44824acbedc5a9aff1a50b8ead012d719f96e5a3cb9d43f18

SHA512
1607e727eb76451e05313d8546ff2ce63b9aaca2d7e2ef15c698cc0ba3de96539bf17b05019296c084c02d02fb011def0c9d0e473b950cc37da9de2c62846ad5

Download Submit
\Users\Admin\AppData\Local\WINDOWS\csrss.exe

Filesize
91KB

MD5
d33c9a65155e13eef3aa5be588c59458

SHA1
089358220be514301bdfb980ac2a3edaeb24f8bb

SHA256
e5c2653b08e028a44824acbedc5a9aff1a50b8ead012d719f96e5a3cb9d43f18

SHA512
1607e727eb76451e05313d8546ff2ce63b9aaca2d7e2ef15c698cc0ba3de96539bf17b05019296c084c02d02fb011def0c9d0e473b950cc37da9de2c62846ad5

Download Submit
\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
91KB

MD5
90218b54e5ac952e34f0d97768acb73e

SHA1
2f060f7e785f5ca36f9b719bf1192d9bac5a82ee

SHA256
9753668c2097332ee3fb5fdc5fe86b1d723f7e43603176da4324024ddc6fbae8

SHA512
4660ac17e4bda9011e846f1a858b27681fe1bf8ae2337a6990983366baa4564c3c738350bd2d04b258f82f36aca2b2129189f88dcb57695fe566240c94b5ccd2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
91KB

MD5
3cd38b7fdef1460d909ff1b879c7c88e

SHA1
b8a69ac84d9c33d3e76e2a8469b42c6ea57b8129

SHA256
05f49aceee53612ee97d1a4cad99627bb3957870f6c5f617e0e75b3e9e57f460

SHA512
7d86bd224ed0180770f1696e29e6fa564f344717c20e38971056fcf51b276dcabb3c7058722c065e8aeb5adf45039088bec8062265e8a41253d3c9d8823d5374

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
91KB

MD5
3cd38b7fdef1460d909ff1b879c7c88e

SHA1
b8a69ac84d9c33d3e76e2a8469b42c6ea57b8129

SHA256
05f49aceee53612ee97d1a4cad99627bb3957870f6c5f617e0e75b3e9e57f460

SHA512
7d86bd224ed0180770f1696e29e6fa564f344717c20e38971056fcf51b276dcabb3c7058722c065e8aeb5adf45039088bec8062265e8a41253d3c9d8823d5374

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
0089ee63171606ccdf01120329ab1430

SHA1
612b69d0f8d6b91ad4af873f82eecf31e9096874

SHA256
f27f79bf1624c68c79bd603bec474e0dca894d0379ce031885af597f66c3e5be

SHA512
30135c12a35bfb8495c2145ab665846212a3c9443f07c3c798524be41ae81c1b3450c29404ff8af1d488086c8174cd33daef238a20187b46364ab84c454b2339

Download Submit
memory/1200-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download