ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834

Analysis

max time kernel
92s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Size

45KB
MD5

2322a1020086f440b4e46a05afbbfe12
SHA1

3fc4dd457b1fb789d48330ed9a720fdd7f1add53
SHA256

ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834
SHA512

c88f38ba00900f6a991b24aeae8a548328d58752aa914d49b5708610e1fdfaa1144a56cb1ba73ec3d6377ba96f6c74b629e28e18b0b9b5d0e5406210afece598
SSDEEP

768:dMzk06sDnriJ3OGKeKNh/UkECjMtvR1VF2r+R5nOwekfZOE:ipDnq+5h/tDSZ15Wwdr

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	csrss.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	babon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	babon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	babon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	babon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 30 IoCs

pid	Process
776	babon.exe
524	IExplorer.exe
2044	winlogon.exe
1444	csrss.exe
1052	lsass.exe
1048	babon.exe
844	babon.exe
876	IExplorer.exe
640	IExplorer.exe
2028	winlogon.exe
904	babon.exe
1488	babon.exe
1372	babon.exe
376	IExplorer.exe
1688	IExplorer.exe
1608	csrss.exe
1712	IExplorer.exe
1756	winlogon.exe
1820	lsass.exe
1548	winlogon.exe
908	csrss.exe
112	winlogon.exe
1876	csrss.exe
1220	winlogon.exe
1628	lsass.exe
556	csrss.exe
844	csrss.exe
1984	lsass.exe
1136	lsass.exe
836	lsass.exe

Loads dropped DLL 45 IoCs

pid	Process
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
524	IExplorer.exe
776	babon.exe
776	babon.exe
524	IExplorer.exe
524	IExplorer.exe
524	IExplorer.exe
2044	winlogon.exe
2044	winlogon.exe
1444	csrss.exe
1444	csrss.exe
524	IExplorer.exe
524	IExplorer.exe
1052	lsass.exe
1052	lsass.exe
2044	winlogon.exe
524	IExplorer.exe
524	IExplorer.exe
1052	lsass.exe
1052	lsass.exe
2044	winlogon.exe
2044	winlogon.exe
1444	csrss.exe
2044	winlogon.exe
776	babon.exe
1052	lsass.exe
1444	csrss.exe
1052	lsass.exe
2044	winlogon.exe
776	babon.exe
1444	csrss.exe
1052	lsass.exe
776	babon.exe
776	babon.exe
1444	csrss.exe
1444	csrss.exe
776	babon.exe
776	babon.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\babon = "C:\\Windows\\babon"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\lsass.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\csrss.exe"	IExplorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\B:	lsass.exe
File opened (read-only)	\??\W:	lsass.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\R:	lsass.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\L:	babon.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\G:	babon.exe
File opened (read-only)	\??\J:	babon.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\S:	lsass.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\Z:	babon.exe
File opened (read-only)	\??\Z:	IExplorer.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\G:	lsass.exe
File opened (read-only)	\??\L:	lsass.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\I:	IExplorer.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\O:	lsass.exe
File opened (read-only)	\??\I:	csrss.exe
File opened (read-only)	\??\Z:	lsass.exe
File opened (read-only)	\??\B:	csrss.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\X:	babon.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\J:	lsass.exe
File opened (read-only)	\??\Z:	winlogon.exe
File opened (read-only)	\??\F:	lsass.exe
File opened (read-only)	\??\F:	csrss.exe
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\Q:	babon.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\U:	lsass.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\O:	csrss.exe
File opened (read-only)	\??\V:	babon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\G:	csrss.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\P:	lsass.exe
File opened (read-only)	\??\F:	IExplorer.exe
File opened (read-only)	\??\F:	winlogon.exe
File opened (read-only)	\??\O:	babon.exe
File opened (read-only)	\??\Y:	babon.exe
File opened (read-only)	\??\H:	babon.exe
File opened (read-only)	\??\I:	babon.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\V:	winlogon.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\X:	csrss.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Welcome Friend"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Please enjoy the Babon Entertainment ^_^"	winlogon.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	IExplorer.exe
File opened for modification	C:\autorun.inf	IExplorer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File created	C:\Windows\SysWOW64\babon.scr	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	babon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	lsass.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	csrss.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	babon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	babon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\babon.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	babon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\babon.exe	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File created	C:\Windows\babon.exe	winlogon.exe
File created	C:\Windows\babon.exe	csrss.exe
File opened for modification	C:\Windows\babon.exe	lsass.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\babon.exe	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
File opened for modification	C:\Windows\babon.exe	csrss.exe
File opened for modification	C:\Windows\babon.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\babon.exe	lsass.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\babon.exe	babon.exe
File created	C:\Windows\babon.exe	babon.exe
File opened for modification	C:\Windows\babon.exe	IExplorer.exe
File created	C:\Windows\babon.exe	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 42 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s2359 = "Babon"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s2359 = "Babon"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s1159 = "Babon"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s2359 = "Babon"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s1159 = "Babon"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s1159 = "Babon"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s2359 = "Babon"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\babon.SCR"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s1159 = "Babon"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s1159 = "Babon"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s1159 = "Babon"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s2359 = "Babon"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	babon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\s2359 = "Babon"	lsass.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Babon hates Norman..:P~~"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.jasakom.com"	lsass.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	babon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jasakom.com"	winlogon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	babon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
776	babon.exe
524	IExplorer.exe
2044	winlogon.exe
1444	csrss.exe
1052	lsass.exe
1048	babon.exe
844	babon.exe
876	IExplorer.exe
640	IExplorer.exe
1488	babon.exe
2028	winlogon.exe
904	babon.exe
1372	babon.exe
376	IExplorer.exe
1608	csrss.exe
1688	IExplorer.exe
1756	winlogon.exe
1712	IExplorer.exe
1820	lsass.exe
1548	winlogon.exe
908	csrss.exe
112	winlogon.exe
1628	lsass.exe
1220	winlogon.exe
1876	csrss.exe
1984	lsass.exe
556	csrss.exe
844	csrss.exe
836	lsass.exe
1136	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 776	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	28
PID 2036 wrote to memory of 776	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	28
PID 2036 wrote to memory of 776	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	28
PID 2036 wrote to memory of 776	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	28
PID 2036 wrote to memory of 524	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	29
PID 2036 wrote to memory of 524	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	29
PID 2036 wrote to memory of 524	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	29
PID 2036 wrote to memory of 524	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	29
PID 2036 wrote to memory of 2044	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	30
PID 2036 wrote to memory of 2044	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	30
PID 2036 wrote to memory of 2044	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	30
PID 2036 wrote to memory of 2044	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	30
PID 2036 wrote to memory of 1444	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	31
PID 2036 wrote to memory of 1444	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	31
PID 2036 wrote to memory of 1444	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	31
PID 2036 wrote to memory of 1444	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	31
PID 2036 wrote to memory of 1052	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	32
PID 2036 wrote to memory of 1052	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	32
PID 2036 wrote to memory of 1052	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	32
PID 2036 wrote to memory of 1052	2036	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe	32
PID 776 wrote to memory of 1048	776	babon.exe	33
PID 776 wrote to memory of 1048	776	babon.exe	33
PID 776 wrote to memory of 1048	776	babon.exe	33
PID 776 wrote to memory of 1048	776	babon.exe	33
PID 524 wrote to memory of 844	524	IExplorer.exe	34
PID 524 wrote to memory of 844	524	IExplorer.exe	34
PID 524 wrote to memory of 844	524	IExplorer.exe	34
PID 524 wrote to memory of 844	524	IExplorer.exe	34
PID 776 wrote to memory of 640	776	babon.exe	35
PID 776 wrote to memory of 640	776	babon.exe	35
PID 776 wrote to memory of 640	776	babon.exe	35
PID 776 wrote to memory of 640	776	babon.exe	35
PID 524 wrote to memory of 876	524	IExplorer.exe	36
PID 524 wrote to memory of 876	524	IExplorer.exe	36
PID 524 wrote to memory of 876	524	IExplorer.exe	36
PID 524 wrote to memory of 876	524	IExplorer.exe	36
PID 1444 wrote to memory of 904	1444	csrss.exe	37
PID 1444 wrote to memory of 904	1444	csrss.exe	37
PID 1444 wrote to memory of 904	1444	csrss.exe	37
PID 1444 wrote to memory of 904	1444	csrss.exe	37
PID 2044 wrote to memory of 1488	2044	winlogon.exe	39
PID 2044 wrote to memory of 1488	2044	winlogon.exe	39
PID 2044 wrote to memory of 1488	2044	winlogon.exe	39
PID 2044 wrote to memory of 1488	2044	winlogon.exe	39
PID 524 wrote to memory of 2028	524	IExplorer.exe	38
PID 524 wrote to memory of 2028	524	IExplorer.exe	38
PID 524 wrote to memory of 2028	524	IExplorer.exe	38
PID 524 wrote to memory of 2028	524	IExplorer.exe	38
PID 1052 wrote to memory of 1372	1052	lsass.exe	40
PID 1052 wrote to memory of 1372	1052	lsass.exe	40
PID 1052 wrote to memory of 1372	1052	lsass.exe	40
PID 1052 wrote to memory of 1372	1052	lsass.exe	40
PID 2044 wrote to memory of 376	2044	winlogon.exe	41
PID 2044 wrote to memory of 376	2044	winlogon.exe	41
PID 2044 wrote to memory of 376	2044	winlogon.exe	41
PID 2044 wrote to memory of 376	2044	winlogon.exe	41
PID 1444 wrote to memory of 1688	1444	csrss.exe	42
PID 1444 wrote to memory of 1688	1444	csrss.exe	42
PID 1444 wrote to memory of 1688	1444	csrss.exe	42
PID 1444 wrote to memory of 1688	1444	csrss.exe	42
PID 524 wrote to memory of 1608	524	IExplorer.exe	43
PID 524 wrote to memory of 1608	524	IExplorer.exe	43
PID 524 wrote to memory of 1608	524	IExplorer.exe	43
PID 524 wrote to memory of 1608	524	IExplorer.exe	43

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	babon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	babon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	lsass.exe

C:\Users\Admin\AppData\Local\Temp\ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe
"C:\Users\Admin\AppData\Local\Temp\ab545a5d3c095b1c3c92c4395a2b1a908134bde54c5ed0666cbb5b6a18490834.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2036
- C:\Windows\babon.exe
  C:\Windows\babon.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:776
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1048
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:640
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:844
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:836
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:524
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:844
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:876
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1820
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2044
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1488
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:376
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:908
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1628
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1444
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:904
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:112
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1136
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1052
- - C:\Windows\babon.exe
    C:\Windows\babon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1372
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1712
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1548
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1876
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\csrss.exe

Filesize
45KB

MD5
e03fa70f233e52bc079712c6ffd855a9

SHA1
e4286f8cfa183ec9f8a503ff21115a399932a3fe

SHA256
3efdb3fedfe25460f6e4d9f8126be262905de75af785002b329245626693244e

SHA512
d3b2412866142b7d9a0e197cd713d32c066b97dd5347d5114f1a0a0b56b3bd1e520501f41c10deb905750b2786ad31f0a7a228a220bdb74774e1f66827925c55

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
45KB

MD5
16a01602e52347463b0eb14f7b3d3f25

SHA1
194d850163368a1c066059db61d18d27a74740f0

SHA256
1711a0be924865233c922e3c7c81cfc35e5865794f04b007da63370b53f47ed8

SHA512
4f8b61b828576712084a9646b348daa3ab16d0870f75be67b25042b95b471ae4db65de74d84b4667432bfcebb54af91aa60f838d197ee54e58737eff4b043553

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe

Filesize
45KB

MD5
e03fa70f233e52bc079712c6ffd855a9

SHA1
e4286f8cfa183ec9f8a503ff21115a399932a3fe

SHA256
3efdb3fedfe25460f6e4d9f8126be262905de75af785002b329245626693244e

SHA512
d3b2412866142b7d9a0e197cd713d32c066b97dd5347d5114f1a0a0b56b3bd1e520501f41c10deb905750b2786ad31f0a7a228a220bdb74774e1f66827925c55

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
16a01602e52347463b0eb14f7b3d3f25

SHA1
194d850163368a1c066059db61d18d27a74740f0

SHA256
1711a0be924865233c922e3c7c81cfc35e5865794f04b007da63370b53f47ed8

SHA512
4f8b61b828576712084a9646b348daa3ab16d0870f75be67b25042b95b471ae4db65de74d84b4667432bfcebb54af91aa60f838d197ee54e58737eff4b043553

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
45KB

MD5
23d056e6a3473843b79c8392352aabd6

SHA1
60eab562c4476bb37e21bb3f3e38d499654bcf20

SHA256
88bc660a611a6ca61dfa51c9f4be4d832214ca74c3accbdbda43562ada528026

SHA512
d418b43ec4642b9ea111d4be6e2f80bf4a104d355477b122e52eadc8bde8a94b988048c23caa597ad1fb754d5b9a9715e0843f9bd9f6fd17762fca68bfe2f8ea

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
45KB

MD5
52325aaf06b3351ac4306c5ab868a3ee

SHA1
df7fa65db417a0af2997d34729d5d11998019940

SHA256
c5a49985c472cee395aa7694349fbae1fd359688571254015e104bbe6a974e29

SHA512
d370c390b102569c001a498d8b80c28c8d38293f1eeddf19cfed8f3c74034e47c5d7c3d77f929ba638448db2bb2a63bac047d682e7bc334df91f044e6d2daa9b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
45KB

MD5
52325aaf06b3351ac4306c5ab868a3ee

SHA1
df7fa65db417a0af2997d34729d5d11998019940

SHA256
c5a49985c472cee395aa7694349fbae1fd359688571254015e104bbe6a974e29

SHA512
d370c390b102569c001a498d8b80c28c8d38293f1eeddf19cfed8f3c74034e47c5d7c3d77f929ba638448db2bb2a63bac047d682e7bc334df91f044e6d2daa9b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
45KB

MD5
52325aaf06b3351ac4306c5ab868a3ee

SHA1
df7fa65db417a0af2997d34729d5d11998019940

SHA256
c5a49985c472cee395aa7694349fbae1fd359688571254015e104bbe6a974e29

SHA512
d370c390b102569c001a498d8b80c28c8d38293f1eeddf19cfed8f3c74034e47c5d7c3d77f929ba638448db2bb2a63bac047d682e7bc334df91f044e6d2daa9b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
45KB

MD5
465459fc5a2ae2d75877ec8b93019d8d

SHA1
7fbdbd2973ec0f62f745de91a4c9c2e2b6a0d95c

SHA256
dfe8cc04341ba18fbf4954f7b68adbfcf90e5c6f21e7d20ce0f2aa50d8fc33ce

SHA512
2187f6470dc802fd0b4b5e441a2ee80dc241db81b78e5441bb297feb5e6bbfd294a077080b4cf9efe3802081f020c1b1e85026ffabee7fee99900273fceec135

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
45KB

MD5
4450715a5a64da4da275c84a1a971875

SHA1
6c72ca1c4bc9ebabc17f226c0404d461187888c0

SHA256
6337392a455170816673bc211f9df58c8d33f695abbd533e8b4353636b3876bb

SHA512
022016818e38080bbd12967305868bdfbd7b0d86344f7541515baeeee8fb1a2b8f45855fdee13d37152ab4c1e31967a504f4df138e2ccc174e92bc16eb878f04

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
45KB

MD5
4450715a5a64da4da275c84a1a971875

SHA1
6c72ca1c4bc9ebabc17f226c0404d461187888c0

SHA256
6337392a455170816673bc211f9df58c8d33f695abbd533e8b4353636b3876bb

SHA512
022016818e38080bbd12967305868bdfbd7b0d86344f7541515baeeee8fb1a2b8f45855fdee13d37152ab4c1e31967a504f4df138e2ccc174e92bc16eb878f04

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
45KB

MD5
4450715a5a64da4da275c84a1a971875

SHA1
6c72ca1c4bc9ebabc17f226c0404d461187888c0

SHA256
6337392a455170816673bc211f9df58c8d33f695abbd533e8b4353636b3876bb

SHA512
022016818e38080bbd12967305868bdfbd7b0d86344f7541515baeeee8fb1a2b8f45855fdee13d37152ab4c1e31967a504f4df138e2ccc174e92bc16eb878f04

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
45KB

MD5
4e174cbf347056307a0bc1e240205af5

SHA1
542a27fcabd70fb625ca947fa1fbe50aaa27888e

SHA256
4185868b1c7abefb2a565d5f918644da10136f54e0473e74ed77cc465b41ab62

SHA512
2a03e4143a2761b6bbf23d4371705576c811d5a38e31b6136671c968b11455a8e31b2b442ccc1c2ea1e4657a37d237e415d5d4072aad15b6f5314def508d39b3

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
45KB

MD5
0e3aaa962c9ee408228ac81c22badb7b

SHA1
080eb9a761a0354d14afe42f2c41107205733af8

SHA256
02d41c70488fbeae01453c068a9e5f466b6a1f80352bf6237165b6fb72adc5d2

SHA512
7248af55c58150b28056f6285b7ba8ea05d2a0a18341807fd6723519a9918fd626b9349d8d6a5429fbe01c0f41a13a0c93a9f17e6a011fac0b29de729e90f14f

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
45KB

MD5
0e3aaa962c9ee408228ac81c22badb7b

SHA1
080eb9a761a0354d14afe42f2c41107205733af8

SHA256
02d41c70488fbeae01453c068a9e5f466b6a1f80352bf6237165b6fb72adc5d2

SHA512
7248af55c58150b28056f6285b7ba8ea05d2a0a18341807fd6723519a9918fd626b9349d8d6a5429fbe01c0f41a13a0c93a9f17e6a011fac0b29de729e90f14f

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
45KB

MD5
0e3aaa962c9ee408228ac81c22badb7b

SHA1
080eb9a761a0354d14afe42f2c41107205733af8

SHA256
02d41c70488fbeae01453c068a9e5f466b6a1f80352bf6237165b6fb72adc5d2

SHA512
7248af55c58150b28056f6285b7ba8ea05d2a0a18341807fd6723519a9918fd626b9349d8d6a5429fbe01c0f41a13a0c93a9f17e6a011fac0b29de729e90f14f

Download Submit
C:\Windows\SysWOW64\babon.scr

Filesize
45KB

MD5
1e1263c6eeb1567bb5be87b683dce296

SHA1
a588b7aaa763177215825862790973cacd1fe3a4

SHA256
bfb0401120eaadc3b22c3e87908cce12fd4459d869df313ca087f522887b36f9

SHA512
8cce80f1ad6e4bfe6d8274a796b47252affab37ec23cd60a3b8c50634be4fd6f61eb97d1f422bdd64b85b75fbbfc7e206746b3d15496956debe096905e5dcfd4

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
45KB

MD5
c3bc0644c230f7901b62318e3c443c27

SHA1
1199122038e2264cf7c590212ba1660da26afa56

SHA256
cf41b9f8c552e6369757a724d88e5ddae94e16e3cbe51e272da9bb10ab7540fc

SHA512
deaf034a9c80118d43dccd4a96067cd8f51eb15ef58e611de40002262b8b3ff3031506049d894a71945a1a7702e0eea45355a2408c34eec39b91af23d4723e52

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
45KB

MD5
c3bc0644c230f7901b62318e3c443c27

SHA1
1199122038e2264cf7c590212ba1660da26afa56

SHA256
cf41b9f8c552e6369757a724d88e5ddae94e16e3cbe51e272da9bb10ab7540fc

SHA512
deaf034a9c80118d43dccd4a96067cd8f51eb15ef58e611de40002262b8b3ff3031506049d894a71945a1a7702e0eea45355a2408c34eec39b91af23d4723e52

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
45KB

MD5
c3bc0644c230f7901b62318e3c443c27

SHA1
1199122038e2264cf7c590212ba1660da26afa56

SHA256
cf41b9f8c552e6369757a724d88e5ddae94e16e3cbe51e272da9bb10ab7540fc

SHA512
deaf034a9c80118d43dccd4a96067cd8f51eb15ef58e611de40002262b8b3ff3031506049d894a71945a1a7702e0eea45355a2408c34eec39b91af23d4723e52

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
45KB

MD5
7d4a81fcb283f273c96b651f4fe4a5f0

SHA1
8b9cff2df855b2bb128438f2c1ca9229a7178d84

SHA256
def6269ee92274812739ba3e7d06a27a8c29f6e74b94586120ed117bd881c654

SHA512
3c963c51250fb8d5cf2e041a419fbcd8877266f6458b96333f5747910ea4ceae7e30f25f036b27deacf10b77de363903558e16e2df2c0388198ae77cb8db732d

Download Submit
C:\Windows\babon.exe

Filesize
45KB

MD5
7d4a81fcb283f273c96b651f4fe4a5f0

SHA1
8b9cff2df855b2bb128438f2c1ca9229a7178d84

SHA256
def6269ee92274812739ba3e7d06a27a8c29f6e74b94586120ed117bd881c654

SHA512
3c963c51250fb8d5cf2e041a419fbcd8877266f6458b96333f5747910ea4ceae7e30f25f036b27deacf10b77de363903558e16e2df2c0388198ae77cb8db732d

Download Submit
C:\Windows\babon.exe

Filesize
45KB

MD5
7d4a81fcb283f273c96b651f4fe4a5f0

SHA1
8b9cff2df855b2bb128438f2c1ca9229a7178d84

SHA256
def6269ee92274812739ba3e7d06a27a8c29f6e74b94586120ed117bd881c654

SHA512
3c963c51250fb8d5cf2e041a419fbcd8877266f6458b96333f5747910ea4ceae7e30f25f036b27deacf10b77de363903558e16e2df2c0388198ae77cb8db732d

Download Submit
C:\Windows\babon.exe

Filesize
45KB

MD5
7d4a81fcb283f273c96b651f4fe4a5f0

SHA1
8b9cff2df855b2bb128438f2c1ca9229a7178d84

SHA256
def6269ee92274812739ba3e7d06a27a8c29f6e74b94586120ed117bd881c654

SHA512
3c963c51250fb8d5cf2e041a419fbcd8877266f6458b96333f5747910ea4ceae7e30f25f036b27deacf10b77de363903558e16e2df2c0388198ae77cb8db732d

Download Submit
C:\Windows\babon.exe

Filesize
45KB

MD5
7d4a81fcb283f273c96b651f4fe4a5f0

SHA1
8b9cff2df855b2bb128438f2c1ca9229a7178d84

SHA256
def6269ee92274812739ba3e7d06a27a8c29f6e74b94586120ed117bd881c654

SHA512
3c963c51250fb8d5cf2e041a419fbcd8877266f6458b96333f5747910ea4ceae7e30f25f036b27deacf10b77de363903558e16e2df2c0388198ae77cb8db732d

Download Submit
C:\babon.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
C:\babon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
C:\babon.exe

Filesize
45KB

MD5
17b389631f14f74bf3532f7d99384290

SHA1
4cdc633475be900492edbc3ff39c3f245458c201

SHA256
6f6e638564fd33eca11605d0ff3b7b5e3725deb8918d754152e6651830fae1b4

SHA512
9a4f5624710c549bbd35780ce8f0fa77f64619e7f6c3a89f2b8218038941f3fbe314f574e56cbd9479b84df43ed3e88375d8ec0fc514a140185e9a01e5acd616

Download Submit
C:\babon.exe

Filesize
45KB

MD5
17b389631f14f74bf3532f7d99384290

SHA1
4cdc633475be900492edbc3ff39c3f245458c201

SHA256
6f6e638564fd33eca11605d0ff3b7b5e3725deb8918d754152e6651830fae1b4

SHA512
9a4f5624710c549bbd35780ce8f0fa77f64619e7f6c3a89f2b8218038941f3fbe314f574e56cbd9479b84df43ed3e88375d8ec0fc514a140185e9a01e5acd616

Download Submit
C:\babon.exe

Filesize
45KB

MD5
17b389631f14f74bf3532f7d99384290

SHA1
4cdc633475be900492edbc3ff39c3f245458c201

SHA256
6f6e638564fd33eca11605d0ff3b7b5e3725deb8918d754152e6651830fae1b4

SHA512
9a4f5624710c549bbd35780ce8f0fa77f64619e7f6c3a89f2b8218038941f3fbe314f574e56cbd9479b84df43ed3e88375d8ec0fc514a140185e9a01e5acd616

Download Submit
C:\babon.exe

Filesize
45KB

MD5
7d4a81fcb283f273c96b651f4fe4a5f0

SHA1
8b9cff2df855b2bb128438f2c1ca9229a7178d84

SHA256
def6269ee92274812739ba3e7d06a27a8c29f6e74b94586120ed117bd881c654

SHA512
3c963c51250fb8d5cf2e041a419fbcd8877266f6458b96333f5747910ea4ceae7e30f25f036b27deacf10b77de363903558e16e2df2c0388198ae77cb8db732d

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
C:\wangsit.txt

Filesize
359B

MD5
df2f3e6971a7548c1688706f9a9798a8

SHA1
e38539857523a1e7eb3aa857e017bf6461b16a08

SHA256
1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

SHA512
d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

Download Submit
\Users\Admin\AppData\Local\WINDOWS\csrss.exe

Filesize
45KB

MD5
e03fa70f233e52bc079712c6ffd855a9

SHA1
e4286f8cfa183ec9f8a503ff21115a399932a3fe

SHA256
3efdb3fedfe25460f6e4d9f8126be262905de75af785002b329245626693244e

SHA512
d3b2412866142b7d9a0e197cd713d32c066b97dd5347d5114f1a0a0b56b3bd1e520501f41c10deb905750b2786ad31f0a7a228a220bdb74774e1f66827925c55

Download Submit
\Users\Admin\AppData\Local\WINDOWS\csrss.exe

Filesize
45KB

MD5
e03fa70f233e52bc079712c6ffd855a9

SHA1
e4286f8cfa183ec9f8a503ff21115a399932a3fe

SHA256
3efdb3fedfe25460f6e4d9f8126be262905de75af785002b329245626693244e

SHA512
d3b2412866142b7d9a0e197cd713d32c066b97dd5347d5114f1a0a0b56b3bd1e520501f41c10deb905750b2786ad31f0a7a228a220bdb74774e1f66827925c55

Download Submit
\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
45KB

MD5
16a01602e52347463b0eb14f7b3d3f25

SHA1
194d850163368a1c066059db61d18d27a74740f0

SHA256
1711a0be924865233c922e3c7c81cfc35e5865794f04b007da63370b53f47ed8

SHA512
4f8b61b828576712084a9646b348daa3ab16d0870f75be67b25042b95b471ae4db65de74d84b4667432bfcebb54af91aa60f838d197ee54e58737eff4b043553

Download Submit
\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
45KB

MD5
16a01602e52347463b0eb14f7b3d3f25

SHA1
194d850163368a1c066059db61d18d27a74740f0

SHA256
1711a0be924865233c922e3c7c81cfc35e5865794f04b007da63370b53f47ed8

SHA512
4f8b61b828576712084a9646b348daa3ab16d0870f75be67b25042b95b471ae4db65de74d84b4667432bfcebb54af91aa60f838d197ee54e58737eff4b043553

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
45KB

MD5
66661fe674cbcd001c03ac5da85dbe62

SHA1
9e47e2c42482f2643509dbfb6b0e28f67fc13ef6

SHA256
59c4a12970b1cfaaa2453d29571f413676fd6e2c645f3f8e26969b78049166d0

SHA512
2c219af67f1b7148e5b6fcf4945f236820924071229f95368ecfdbbd123d65908faa7b7c5e849679f4ced648c4025d3a1996b2d0187453e1857e6365c48cfd76

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
9c83b91733fec8d14925a522017b798e

SHA1
7e18e5d786b790a2477a7156b86b795a7f217db9

SHA256
cb4791fcfd6c83089182f02243f5c10d6ec0dcdab9aa9d6cebe0311ee6ea7dd9

SHA512
5b5faef3658b607a8c1026b8d14eab0d57bf0c7c1cd154138ca426ed4f2d80acf2c8e6c5b5d6db83c57539c31575e7178f3b7fde5e17e2c5e958be17092c2350

Download Submit
memory/2036-56-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download