da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
Size

1.4MB
MD5

ac973d02dbb26b8ee2e52bea0ad6b6e6
SHA1

0fd4cfa507c8ececc891648a850ec8f3dd6eda19
SHA256

da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00
SHA512

7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201
SSDEEP

1536:7Eo6GzI9cono/es2KyvLh423iZB7LbGnkBwUDXLY+cnCd4SztNXjU8UdatVgc1h:g8ciono/e95vLh4j2Umns4khjU0jZ

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
1780	winlogon.exe
944	winlogon.exe
360	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrte.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tracert.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kis8.0.0.506latam.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csinsm32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedapp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcuimgr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netscanpro.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmntsrv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe	winlogon.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1472-55-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1472-57-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1472-58-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1472-61-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1472-62-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1472-70-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/944-85-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/360-86-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/360-90-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/360-91-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/360-97-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/360-99-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 1780 set thread context of 944	1780	winlogon.exe	28
PID 944 set thread context of 360	944	winlogon.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bb7667a908d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1203"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "146"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://63tv9b773se6u83.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://5ur8a94b9zi2b4i.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://sbphd7bd2165p0b.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "140"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048bea50bfb70fb439c9e9af333808b8700000000020000000000106600000001000020000000f6bd9f3dcee3179cfd07667852d79dde63ac8f54c8ef3c428ca6fc66245beed8000000000e800000000200002000000073974a166b7530d6caf035df1e615a4fbcb4f52bc5fc024dab30c42d5720e85c2000000091dc3e061a4d8d4bbbfdc6322f5115e2621a81fe6b687896e04ac9b58fb7425940000000f92c1211196816d98e0c105988562713b816a2204112f5525bc67a30a424583f69e5fbb2cbe28c8984edc2d90a4491c1b47e80b625bd991282fd5b7946877f00	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "222"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://91607lo69l50q4k.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1228"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8310"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1203"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048bea50bfb70fb439c9e9af333808b87000000000200000000001066000000010000200000002dcd6674253dac88cb67edfd080020f8873607ccd0a85933185c172e583dff3e000000000e80000000020000200000000a413852c02413cdd5d9dbd8e90ce0c84b99776acde8112941eb9a3aa96a91f89000000013120395e0ccb06c9f50d6872136b987ddfd43eee91f874489f62bf942499f4000081a9008356a55cb0d5969f31570783cf0e29ee41768b7ec308859d6b9abe35bc0e30628acdd1c5a610da8a1c78d2ae1319d41f659c97817861c85f40fab982033e716e354b97322a90df3d044754c4654b5b2d4a3a165eb97b0322dffcf8801814554164d6ab6a947e57de792744540000000c9fff5c3a48c7c9a9d5738044673f911c038adcd5b27fc453227af7c2cfab4d7f52f477e77dbdaae3c5dbed7e7928d51f1291590e70317a95a5c3d75c9a96327	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://zc6oni88t2gt6e0.directorio-w.com"	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://k3km5a282ba6w27.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://jy78h18bo4u0qix.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
360	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	360	winlogon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
876	iexplore.exe
876	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
944	winlogon.exe
360	winlogon.exe
876	iexplore.exe
876	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
876	iexplore.exe
876	iexplore.exe
984	IEXPLORE.EXE
984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 2020 wrote to memory of 1472	2020	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	26
PID 1472 wrote to memory of 1780	1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	27
PID 1472 wrote to memory of 1780	1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	27
PID 1472 wrote to memory of 1780	1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	27
PID 1472 wrote to memory of 1780	1472	da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe	27
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 1780 wrote to memory of 944	1780	winlogon.exe	28
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 944 wrote to memory of 360	944	winlogon.exe	31
PID 876 wrote to memory of 2040	876	iexplore.exe	35
PID 876 wrote to memory of 2040	876	iexplore.exe	35
PID 876 wrote to memory of 2040	876	iexplore.exe	35
PID 876 wrote to memory of 2040	876	iexplore.exe	35
PID 876 wrote to memory of 984	876	iexplore.exe	47
PID 876 wrote to memory of 984	876	iexplore.exe	47
PID 876 wrote to memory of 984	876	iexplore.exe	47
PID 876 wrote to memory of 984	876	iexplore.exe	47

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
"C:\Users\Admin\AppData\Local\Temp\da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:360

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1576

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:3814426 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
92befa03a7c35124ad47591735df0972

SHA1
bfb88699cbc008974398da97f189b5b6325d8520

SHA256
ba7e165d3126a33d77e5822f10675d2e029a399e43331e32968bb171107b2e2c

SHA512
83e0cbdfbbd9f1178eaa5e5b9310ac5c5da9d59a015440de47138dce99e6f155f22b5eaf6d842338eff65a2d39eed1f9e6042792f222d24c02814a65d5839ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
2e388f1ab4ec88104f57cf23944ee684

SHA1
39178c45ed645709cc388d5790b1b58a3272a62f

SHA256
e33b88f6f77d90b65a8fed943a45623e51f1efbdae401a1652f24be68408dba0

SHA512
22af60fc3194a92d63f24d32ad053927e046c75426f14d30312d878351aa7f4fcfc1236c3d60a08f0b8474643203e1f799d96e3ca1b19b7d8c7e65638a7859a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
d5d82c08e6fd869fbaaaaf1765526e41

SHA1
94b72e5ed611060f4b465502ac2ae4feedc89575

SHA256
feb7a9e2a2e668c38ca21a509c6f235afb74f9576b24f69942f6efd3261db142

SHA512
e7eaf0e293b5c49674cab857140d0d8568ef12f7aa1c5d3410c59601192a61b56bc7d1ecc83f232be87dd3f7ad40c422c0b78a6cc741892aa9164f37437e0deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F

Filesize
7KB

MD5
406b3f4c3dcb12ac7ee515803cdbaccf

SHA1
48ce8c5e2a34f081f9f2f8de76f9c9ff8186a351

SHA256
824b08bb5371b3583f45b4c08037edc08b30860079d8a6ea5dbee813bc7625ca

SHA512
6c700f89161ed263cf4a13bdf28d8dfaece63c52a50487863ca43a4ed584eb55eea5c2093275421439ee887752195692a3242e8621dcf2bd881c99214c5afc92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
279B

MD5
82950f87efac8cae3e42b2027b799f81

SHA1
4b0506380d56cc8cae843e0ae869db33f0230272

SHA256
5c5164f232b0770bde7a9c3cc4ba12209b41b27519125c11dca9307141dfbd04

SHA512
87db89c122c2ec7610e3bf0ae1461023bc1602ed3647a07453b3f6d58872bca9190f4bf4478304e9e10636d4df3a57017e6b694868b04ab40977c50bbc87320e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
472B

MD5
79c225db327a78b782f5a9512b07eaf0

SHA1
398a1be3a70264d959146d6670d2ca54cdf4e91a

SHA256
8539ea44d81775448ae8c6179d54d8a397c559b112291fa78abcf6ac6c480815

SHA512
f01bc8382af3de4d988438e97e2cfc11d23defdd7a7b07191e884090727004cda132a6333ae0121d10bebfaf74f1ff4e91afe034da535ac3340d2cec5930d8ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6

Filesize
471B

MD5
835ce3e7ef4019dae4fcf17d8d57c703

SHA1
5e54e744b264709166c366679cceb9102a54287a

SHA256
140975ac32015a3b13e758f6f7caa621b5fe2f0af284cf899d7ecc90a6166ce3

SHA512
47dc1c72e9d7f9e254081e30562335425f8fd21e97311bc7e507e0f84c87daa840644e2875593690c470535c081cd7bf8bcaa196d3922d8db38dbe1b0d8b527a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
09f3470a0e886b573811f6d2c08592ed

SHA1
44ea13248459f11ae34fe60da4a6078755821b75

SHA256
ee120b1d08147be2929c798e68d274d54b5f41b369083ae80b548a2ba88651e0

SHA512
82020f4b662cce02366429e306d0f9565e175af69cf935071b061f18bf0a5adb9df0b1ec7b12d08cf84516a9f992b71f383cce989902c9c9b784295590f2645e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
472B

MD5
5f16a534222e5749ef240d413826c2f6

SHA1
11683d84d420dd6f919425094edb8961278f7fed

SHA256
691ebf7feb1f7d6ae7e5e7efd678626c62042dda520506f262c7d9a67a48e3ed

SHA512
7b9a957ef14a0d4139d120d95e3d41a9d3a858a5ced8db18168742cdf377d0ede9673a055098ff6c5de813880fc7d9329a8dbf1258e34728bdb348665af50969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
472B

MD5
5670c32d73c3d5771a2d9396774a7eb9

SHA1
3fb62916ff54f22a011e11730ba87fea48e5d239

SHA256
062531ed89864b713048421c9639d4a6249e92f33ef4177206f1deb5d85a8757

SHA512
3c1b6bd13ce47917d7c19a0349bf6778344cb5b8d3e277b5ea872c3e043fcd6e2850520642c47f746cde6e83abd24c605ccde67af7e1329c97aa0dfcca8d97cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
472B

MD5
7dfb548d8f8a99d32050803775fad5d6

SHA1
8b47999a01db7c2217d76a1cec576809a229cf1b

SHA256
68dd2a1e5a0002f4d25d3b5884ab55bc6b5a91e38f6dc464c4261b19c6e5887e

SHA512
846fe7d6ffd6a3c8cbad7ac0d887e69caf7be6713cefe565b2aab91779583499b1af26dc9a1e9870278f2ed5ffd67440e4093b92f51addf378b1fbdf2bd036a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0f6123433c0753190b5bff5c04b4ef8f

SHA1
80afb025c4de473177c93968568970fb3dfc7a15

SHA256
e7fe7718afe880506a87faa7b4103d91f6f78d62ea5fd912d01a1ca7fcc5b244

SHA512
6106cf6edc318aca42e04ecbd33481e283a8758ed250e3d29f982d0165193c1c99cac61116a56f9d3fa6188afaf207f1cf4b0d22c3bb8ea682b9cd9a9d9c07e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
6993e9fc3b6bf8055c672afe1231a1b1

SHA1
3cca829df13d85f09a2e485b1d266b9d81266a22

SHA256
d3bbc7aee201a8254bdc70fbdfa8f69dca12ad5516766b185e0c4ebfa5f27efd

SHA512
e314ccd8fff285954090c3c0707d74bf6d579dfc9a9adcb2db9e134ca81f2d12d37a8720199c2c4891246a673172995d06f20d79d9f81f400daaab95632f134e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
b161fc2c309c5e93621c70e490559e5d

SHA1
815576cdb6f5c1acd978d2d7843fbd34822c2d45

SHA256
b6b5d5f9d38310e03927b609c8814cea57d6221b3a94d4b69e1690c382a46ad6

SHA512
569bef1a60b588751788b559763a069ce201436c4633dd4258b7f96978405a29c558abeac938e41d60641323cf18921623685efc5411ad8993ac0653adb9e5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F

Filesize
232B

MD5
5c125cfbdb767338cc3e5c9c8fdf66a3

SHA1
0e5f8dfc14bc57860e79730c92254470d59e5621

SHA256
172da648c661ca353b3b2cbb2adac4985bd7cbd01e199e7845cc3f67ff0a5c71

SHA512
1243c28e0b2b4adb5ba6e37a32b233511cfb47495da59ce7f381a1278059550cdd1445be69cd3658c8bd13553e83bbe2dd26485206425452f8c48c3b566886bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d63dd057861a31c43bbb85d3540bdc

SHA1
20eebc95226d9a326123f9adfa6421e68b80f40a

SHA256
452aa5b756aecccb45a5d9510e4af10969462f75856e87c9b0d398b3cac07fb2

SHA512
282c572a0bdee29842e5e345489847df575e1fa2567f58b08d6c65b41ab22bfb9cd596d0905c592fedc6aaf9b0f1242693ca64386965fd97b4b8c87aa3210572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b0574ec0125e390e34d0633a40582e6

SHA1
3508c6102854854479df4c1ff0703d3e154e8c2e

SHA256
14ca13517a7cba228dce065689b602f9a927e910eab004cbdae9bfffc7ed29a8

SHA512
3dde13cc58fa441e9f05d8077ae207c2eb3c39667c0cfae99215be7374bbb06e4d5fa96fca9f2ae0184f54d21786b1afd59620a1ae60b5dc739a6222f414090f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1271fc6061cfb5aea7197dee8bb47e0

SHA1
59a40c152363816cd9b99e3a2476bad53a5bf4e5

SHA256
84e6bd0e04cfd731e61c4045ed9beb7619f47040f3625e7b07c8f39dd9eb1237

SHA512
e00df7d121e97ed0fe2c83bdc0c9910327864260c4e4c8fbcb90acbe111f17fe57a5e811eb699cea42b7a926a9869d851e5759ae4fe7dcba22b61edcc1964d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ce6855bfec81a4fbf89ba6ce568933

SHA1
1081a1dff36cdf177a72fafcbf00e44ba867a031

SHA256
f38c2914f758848ebe0c5a411c55f7c3866fc943aae3db72f98c8cbcf2641c0e

SHA512
c5447d863f39b4cd9ef33385fac4255af0bdf72dfaf1ba17087b5f57fad815f7c538b55a9a1fdff09199db6ef6a5d013a8950f28018acc9af2fa97f215a49725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f82cd45b1a9607caaa9cd3e5b743fd26

SHA1
f31a77db614e42a22341f732042064b2a04880c8

SHA256
4a2e2047928ce371b5685eca04bdcac6aedabe8ffd6657bacbd6608ffe507d56

SHA512
a49c1c695f44a27e9e499e2c67e84c20157ae9700544ed919dc656c7114d6b5d29782109d4f5ab5170f698697c39df34ce350d2c8d6a6d5d090412793cb5749a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
426B

MD5
74cc72e79dca77561934e5e0246a2089

SHA1
8b178cca7417da5df337ee794f38eb54f620b4d8

SHA256
09b358148e7ac0be5a97974d63f936587bbc083a82eafeae1210939c3798ec83

SHA512
8fea34461753fe5ff7cc4f61cbe8a79694d4c857e3d644c9442627921469e6d01bc3508f35dc05813d9a28de7931b2f36d7c615fe0a453a1d6b33a3f0e7e4eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
410B

MD5
140110c1c99290a03bec44aebcbe739f

SHA1
d0f7687b8477708df6dfc5dd2f7a0a177c4395ef

SHA256
b757e3b51d1d52676de0168ef20ccf909230af8baac7ade9a729329c077e486f

SHA512
499a6467b57b79caba0345c42335b14aa215abf76a9555a06d178d1142edd732c94e47a72869a7b882f7b6b33d58c90573441bbaaaf9c4d7f45a853d7cd75709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6

Filesize
406B

MD5
b781eccec8a8fec12873810fbdbc2a87

SHA1
8c2528433ef9d553bd1903f354fdd76a2c145922

SHA256
98eb6157e5cb473c3f5046836c15ba2481a49bf78c67f85e7153f0a998d3d213

SHA512
7e6637d51072feb863a2ed703cb0de97c74b7f69f81a8c07a7aef13d63948450caa5caa163695b551f6b88ec8a38e36ce1bd1bb0434735242f25ff913df0561e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
404B

MD5
0c9bd74b25aca11bda1b8e62e8ef8094

SHA1
edb1c7985c6182c5165f5a890078270f44220800

SHA256
f1b37802302e7fbce51d361fe1a164c54634381f8c09f9e4e93a2787ec559ff8

SHA512
edcff58d7f8e898c2c90d0578f97aeedbf5ccda22ebe81b15dd841ffce2c559f1580bf90c6da24494e47b55976da099961e3199f0465ec33f5c06ac4f9aaa85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
e437976f0a8efaae92f5bf41592788ec

SHA1
4abd388c25cdd9e98b3c1257335a239ed7f7da8d

SHA256
f151a5a9d95378d6013e825c2610571de1b41933cd816e75fbde6d4ab44b2f98

SHA512
35e40fd5916ae2a4c9cf478ae9894e4b5fc2dfe7a51716cce8b590164cdeb18b43fbe0d8264fc90a9a08fab247f672cc42d625cf80211fe15f17ebe656fbbc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
402B

MD5
c1e7a22b1c5658f7bce158f1ad069eff

SHA1
c5ca3d6ca2020e50f96159099f8da0ba3e40d6c4

SHA256
9180f9b312e20060e99fc0018ebe4218cffc419ccb76046e5e0b93110912b8c8

SHA512
9867eff6cf25b694e4005964ce1ca4fce162df956a27858520acccd8200f1a28f3616da504adf4d2c727b459139de3cd097515ea6fa15cc466ac5b031f2a2e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
406B

MD5
c28103bc90af0f9500519b440a626b03

SHA1
5ab31327d0f78bb107f980e0b4652dfe43635025

SHA256
3d5cd053951ef7c166e5d0cf9be79ebbb6de84275fc9d1eec19a4ef018bc0c7f

SHA512
35caaa731e1635aebbeef36153a2e9337cebf752a6b541048b88a8e0a98f4bf54d6f047e909886fc9531f6e100efe771c011a0bdd1b84bfa5871ee313da81326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
406B

MD5
92e99ee36db40206f19e44d60dca1b6f

SHA1
42d3b0a3513bfb09a7fbafd84b763c82841b2a0b

SHA256
3244a158a0904fe4b81bee3c4892dcdc078bcbd44afc90a3edf22615c8b7e114

SHA512
0810d1a2ef95092ee1cc8789d6861f81ef0b1c19dc6f1518caf8f4a500cd2c1bfd93c094c68fef3320ef394262cf0c05ec9d9fdf6bb10f7148a0ce75b44fb0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f0e4cd4087fec5488d347b69136e8991

SHA1
1a4e3c425156e12dc85c890e89f5c14145ed7284

SHA256
aa4a7fb2127baeeb898c780620e8d8f8aedaf49e4635ccc924e7b433cdb1a5d5

SHA512
7c49fe092861087878c2c9167b5d35ca63d9f5f9715b9251ec5c044ca1b7196d644615dfe82ca13f13bae781a8b5cdc64df3cd287042a1ab9a4c1420f170b24e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
116f124824ec7ea249e04660a46e0956

SHA1
80bda4fd5ae45f3e1dd5b9725bd4dcc353877d94

SHA256
e300a9c60645cb7a90b3b1e88ca99dc2d41c67782795c40e3e6b1fe6f4560ae2

SHA512
261ba161ebbda01ff4f3fcffb2ed3d23fc17ee34ee2d4193037dbb65eb12aa62b3870d2aa853831ab3db3564efa40271af959d1ef7f560f9929cc7bd70f21c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JH0K1MY8\www.google[1].xml

Filesize
99B

MD5
b093e182c6a55ce6022dffe51d7bdf4f

SHA1
4778619fef8ad6486af449deb6514dd8c977faf4

SHA256
d28171ddacef59ce433fcef0b987c9114981edbbb971aa413e4568d939012e38

SHA512
c4a30031d3b730a3301c711a1e9acb4e436328f5559d617a45ccc4a40feb35cdeb91dcd3e200b4982e62b7241fb806ee0fd6e162ee526b4fb812919e458dff69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\VS78ZG1V\www.hugedomains[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LYNQJM7\recaptcha__en[1].js

Filesize
399KB

MD5
b2507198388fcc94ca9e94ed4c5561c5

SHA1
8853fc86f1c616bd20a73e3e24442036fd90fd2f

SHA256
02c7565a86d6d3a80295b85161d78fc88d8c79a0e314c0c7777570237a365ed0

SHA512
9461ec9b79eaf72e85744d4fba9f18b3d3f1f9b3fb28f30fc2392f5740e21eb11a73f15700e4d5c4af9f2b582c4efdbb8d3492d4a14e32a1e8715458c9e464d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZW6EW7WZ.txt

Filesize
606B

MD5
6e649a82eb95c7c5b6e2be2fc7b2e670

SHA1
33c860482031a558a7de0d3a1447d1380528034e

SHA256
74145120bf935b4cebf5631ac99e6e1bedaddb184161df2bdd8dccd1ccea3d88

SHA512
20c0eab6f1e813122165fc4c2650f425744a52ad9cc90ec3f43893bb1beb29489e4e95cc2141cfd74c4de6667ad011b39806c1ba5e11ed310940cf45416db88e

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
ac973d02dbb26b8ee2e52bea0ad6b6e6

SHA1
0fd4cfa507c8ececc891648a850ec8f3dd6eda19

SHA256
da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

SHA512
7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
ac973d02dbb26b8ee2e52bea0ad6b6e6

SHA1
0fd4cfa507c8ececc891648a850ec8f3dd6eda19

SHA256
da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

SHA512
7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
ac973d02dbb26b8ee2e52bea0ad6b6e6

SHA1
0fd4cfa507c8ececc891648a850ec8f3dd6eda19

SHA256
da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

SHA512
7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
ac973d02dbb26b8ee2e52bea0ad6b6e6

SHA1
0fd4cfa507c8ececc891648a850ec8f3dd6eda19

SHA256
da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

SHA512
7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
ac973d02dbb26b8ee2e52bea0ad6b6e6

SHA1
0fd4cfa507c8ececc891648a850ec8f3dd6eda19

SHA256
da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

SHA512
7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
ac973d02dbb26b8ee2e52bea0ad6b6e6

SHA1
0fd4cfa507c8ececc891648a850ec8f3dd6eda19

SHA256
da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

SHA512
7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

Download Submit
memory/360-86-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/360-99-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/360-97-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/360-91-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/360-90-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/944-85-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-70-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-57-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-65-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1472-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1472-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download