bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

Analysis

max time kernel
150s
max time network
168s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
Size

833KB
MD5

ef340e8cf4f94565b1d75b56badb3b9d
SHA1

e9c8892e1978d20ad65398bfa873afac3d937fa7
SHA256

bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254
SHA512

5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731
SSDEEP

1536:ybcbXVDMo9fgw5Y0ZlUmp/xLVQ8GW9AWPdApTbJ7mLcaQ9yrKYcU:yWMot5Y0Z2enQ8G0AVpTTaOyrv

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
1344	winlogon.exe
1300	winlogon.exe
776	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2002s902.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\penis32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monwow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmoon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpsvs32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nd98spst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupdate.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieCrypto.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamauto.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2k_76_1436.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ahnsd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95_o.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdetect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/996-55-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/996-57-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/996-58-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/996-61-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/996-62-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/996-70-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1300-85-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1300-86-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/776-87-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/776-91-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/776-92-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/776-96-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/776-100-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1456 set thread context of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1344 set thread context of 1300	1344	winlogon.exe	29
PID 1300 set thread context of 776	1300	winlogon.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9900"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6413"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1478"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4755"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://kh16wo171c9f6hc.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "307"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9875"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5586"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://xw9qigz61h4u3dw.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://799w1s4w43795j4.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1453"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10775"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4730"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5650"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4730"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3208"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3966"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "13875"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1566"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1541"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1560"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2320"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2295"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://u38plc6x75pj6tw.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5675"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5561"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3884"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1535"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3120"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4648"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6413"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E04D711-7586-11ED-8C74-D6AAFEFD221A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "198"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "13875"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6438"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4731"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://3eh913x5u3g4t55.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://t13zqj1yzi546l9.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
776	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	776	winlogon.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
1300	winlogon.exe
776	winlogon.exe
1516	iexplore.exe
1516	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
320	IEXPLORE.EXE
320	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 1456 wrote to memory of 996	1456	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	27
PID 996 wrote to memory of 1344	996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	28
PID 996 wrote to memory of 1344	996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	28
PID 996 wrote to memory of 1344	996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	28
PID 996 wrote to memory of 1344	996	bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe	28
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1344 wrote to memory of 1300	1344	winlogon.exe	29
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1300 wrote to memory of 776	1300	winlogon.exe	32
PID 1516 wrote to memory of 1240	1516	iexplore.exe	37
PID 1516 wrote to memory of 1240	1516	iexplore.exe	37
PID 1516 wrote to memory of 1240	1516	iexplore.exe	37
PID 1516 wrote to memory of 1240	1516	iexplore.exe	37
PID 1516 wrote to memory of 320	1516	iexplore.exe	39
PID 1516 wrote to memory of 320	1516	iexplore.exe	39
PID 1516 wrote to memory of 320	1516	iexplore.exe	39
PID 1516 wrote to memory of 320	1516	iexplore.exe	39

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
"C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
  C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Users\Admin\E696D64614\winlogon.exe
      C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:776

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:2372616 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b0a042e2e7b0e4ffd8774a10d2d4f418

SHA1
dbe2ab9066f96c09be7a64f73107225f0cf022da

SHA256
2b01d2c1cb508c48ceaf433f6cdef6d03ae47d2e474044863ef7a630976956d9

SHA512
9374a25065761868869b396af3dda24e6f3cc3b071574df83d128819164f528aab81d5b9ecb9f16d5612e3f00472ad47d7e138b9615ba188895be83b2d7b7960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
5006b8e985c5838b7fd2f2b558a65bc4

SHA1
183ff15e0faedf346305fd6fe1c70c9c7a1eef4a

SHA256
fcbfec9f5fd0e10d44778c1df64d8612281cd39881cdfd0aa8ca30d13655655a

SHA512
56526aaf34500a94404e83461b3580513be1f07b288485c7059fc1ec86b77cda50da613b7def2fe6a8e2d04bb3d522fdffb5f7e9293eab06e86cd2d6af24a1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
c4cd028e77dc29d429ba8b5626f59821

SHA1
23badc8d3ed484d0dccf07f16447ba8793e7f02d

SHA256
5661d0cc5dd7a0e55f0c9004e60bf72a991dc0f3134fa36000fe67bec4f0beee

SHA512
0733792a405c2a59cbd65941afd4afd2365f717884094be7d76b937875691815e772f1df14d5565ec74515e018d27769e9db68005a56abf4460e8158bc208447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
280B

MD5
8bb08a63846c404ad473dc99fad2c947

SHA1
27829ec49f18684ee0bb127f79c34e73eae1f7d5

SHA256
3eabe5f3ddb4b323eaebe62f79f514dc1ef5fa4380576f0a7382d6808203d41e

SHA512
09b9f73b0ea352be2dcd8ee0e8d8737a924a8752a5987b69901a4d45a141ed515bef2f8df33ced44dc797cf94737f983d33f2d6ac79447921b976889738c286f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
472B

MD5
e24f2da4ed2e3cd07b0999a67550d634

SHA1
6e2277e734fd0015849c3554dd2cf2ae289c2cf2

SHA256
74dc14d7d9ba8bba4a162680e59801af1d7c2995639df51f32ff2f3d4d0b0051

SHA512
a7377435a4325196b5eccea56ec8cf4017908e9b587914ded4a1e68839b0771403842c05b4400eb1c3e5a010e4bd2580a361e92b39ad3e156ce9a013ac575c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
f1ec80022e25a73962f62896d5d47f7e

SHA1
10634c7f4322faf9f78a01d0dbc24fd331c1bc53

SHA256
155b9f75d0bc3fefa3a902fe4a9128be11af38528b807bf849af9fc8a2fb3934

SHA512
d7b67e56aaa9078641e886a4e694e0f742c4a81c7559f3e03cd84e0560e7265a669c82233a008cc2d93f56e7562d2611817770ae97712570c935f3c7997aa863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
472B

MD5
3ba864a4daffd79d4639e98e35cf5a8f

SHA1
4e2dfdbff3ce773c1c39031bdf854e2b0a31131c

SHA256
73a684466e34cc6ab4250dbab0c6afb73a92c4239e37076020b9e1c446b69b7e

SHA512
0b1e6f680c9b5e1d257453f2cf6314986feb168926010d9f86fae5daa1a0185a37eb49bf196a3edd2aa60734121a252794d32ae2387cd933d5372e83d8087f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_3D61C5DB88562BC5E38E0D66E2932BCB

Filesize
471B

MD5
9ccfa7f99417972de398d4a4a9750c43

SHA1
ef0cde9c3e43020fd4922722e9e491a7158bd2f1

SHA256
6d4f7f04f34215e6afe32754ebab012088ab942931f7cf38fa771036d16d272d

SHA512
f892ba033d96700283f69c652ef57220e4b2c5e989c7308bf34a1301c5beb61eacb572d4c198292dd64aa93c2583cc34f2891d0e6020c0e5525dada04c59235b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
472B

MD5
d9339bfb0393ef6575db48a0481f2556

SHA1
351fa573fc3ea6626f3258061743cad65e0c4fce

SHA256
5890254c4fac81ab169d788b9e5f9100f36e1ea2a2a6fe9036c45122aff062b3

SHA512
81689b048b7a41c13aea611653b7223b87220e69773a97cb9eea9fb841b1966dc7905fba561f050197746a14177cf4c8c374c2fba1c6313559a5f9adcfceb94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
472B

MD5
c10bc583c46449dc192a809398b4e814

SHA1
ff0f7ad905d32d7f3d01e4054552d0ad551503a5

SHA256
defd2b2559e55c9c6c0f8be9b23c53c4e781a736feae3dd73b4d203b69cfcc57

SHA512
702431b66d5d370ed7413169f07fc4152f1a42747c12c4269ddba5582f7e2ad1f5617fb2fe267816f0c219cc9d87b8d0de685938c629e7ece18cef641ec11631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
79ce3a7cadae6ba9c3b819fe6928c18e

SHA1
ab3d7077ca327d1739d96e920c3a977c3253cf02

SHA256
4b4180c177d816c942265320a695ee6b3826ea92a644e35ebca48a094fc312f2

SHA512
15ad0a071c7100365f95f85b3e05d93c4406ca2965f5e3c68cf4ff1029cba2e30932f05ccb2daa536336826ac3c9e7f87b850a9c29f72ceb9d36914674c71161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
480ada443f76becbadca17d39600f2cb

SHA1
c090cf59b0a572f9caf16fdc039519717ba6832a

SHA256
d6fbff1944675b76005d41bc48de1f02b1e927488ce7975ae420ca4cec239c31

SHA512
1f1033c2171ec984ffefafcf206fb6e7851a26fcbc9b8a9c789f578d2c4ee094c39329bd9b613141053acfed2c1892387f07c8f325d1eaa394ed39fed082520d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
953a7d764f434eb3d8070dd798faaa38

SHA1
6a075637868e5b90fe35df88405bfa40e6b434cb

SHA256
ddad8d943eeb954c92606dd6931f1db702058feac3ef4cb4c4ed45760e7bc127

SHA512
4fa3105dc79f331d82953962d284fb06a93ef5077fa0ac954e80fba736d24feef570dc7a6626064cbab18c956611132a0485fc6b8b7789f6b5665c98b77bbba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f547168e92b044c3af6867f1d072045

SHA1
6fb155c77f1a0fbd327324d33ff6e20b3bc1ab32

SHA256
bb95dc7bc0b492ad1915b6061467164e5cc682722b8c658d1ab41ae95f861357

SHA512
1302d285f56b631fb2faa9d37f2a493f45f9a0cdc31009a7c9205411cc37b0d8786ea92d29df64c94328ae73504aea347afd1e91d708229f85e45feee8a730df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bdcf61b036197b7239f90a22216bc8f

SHA1
3afef4d54609e28ad2a5b68313704f167da86de4

SHA256
358c1a0bacb88664b65f5f4133bd373e01d13395ed7ecfaaa1b8ca4ef23c90c2

SHA512
85f62037fab79fd87e54198e309f537312d121c2fc46a78c7029d483853eb19d0c509ec5a24e32469b0abfc282b59d50a9ac2700dec3913f8ac2734af24916d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a848cc953bafecbf6de0ca575eedb8

SHA1
f08c2d7133109779e3e511f69796b9ec67fa074a

SHA256
4dbe48e1f7ff31b281ff997d10f08c6332863b8c00fe0c065fe071d879ff67a0

SHA512
a518494f09520dcd57633f901a371d138cbc35c0c275f3c2a82cfd0c4fc96e5f792dbe697dbff3c59b7b1b8d522b7aa43bc85ec2ef96030e42fa8a89c0940a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89c66d31f3b8fe4ebfe2ca32fd59c01c

SHA1
b29b95938858c3c411d76e603b34532c5cd6e29b

SHA256
87319092b75334bae6d2aab12d6e4baea2eb2ae71619dbfb1cc50f27c3ae7879

SHA512
deddf10eca6367849c7f9ee8e129b6121dc6a5017a767a0dc1984685ae4b364379ccef7272c5135282c0944cfa85e5aac45c6c83be52f324c76be6fda85dd453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445f3f17b2aeedef79c7503e28a44656

SHA1
82cd1ecb21f6837feb8d2636de9aff5d7af04fd4

SHA256
a4a1fa6bd7d88ff64e24895f649627bcf1f04a7956980660236be77f965d5b1a

SHA512
cbddc6def71ee50e5ee85cf111e2129621b6212a505634505a31c2b6c8b9b3d83efae791d1c3091541fbb0fa0406b362dc479c7163350aa356029525e877e328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
426B

MD5
8f202116e84bdd01fe1e5de7f0d52ee7

SHA1
78212bdcef72ad45bb556838afc77f5c2019128e

SHA256
b08dee16973d9d7b7b962ad93ea657b988bcf05308491ec1f821bed2db5d0d83

SHA512
549ea4bb48716fc332addb23683215b4a11945099660fa732670f650bc20d8e1112f8246b0a354a4b9ab43fefe6e62cd6b0aa905210f58aaa4bb967e4913b851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
410B

MD5
62ec5080becc60738552a05abbc60726

SHA1
6a8c7b38e5eeaeaee6ba24af7c3ec1e156dfa845

SHA256
0fd42d1ca6532d4618150cc363e19ca9e697eedb39240811d5c1ed64f2e9daa6

SHA512
470cb33ad8744f237e60f0834bcae2da125f28125a09b3e8a7ce08280fbfc36acb49d697181b38b722b430af3fac819bd2ed9d247ba6ec81a19fa3655b743437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
510dc3683ab17ebeb5088e043d86f594

SHA1
fbff178c51f9b494de81d88d94bfbf0e424960ff

SHA256
673110b699249a3d89bc0de68e45d9b1ff6d1457ec81ee6deef3d42b6cffe180

SHA512
6ca05558f1b3ddeef44bfa66bd87eee4e5b2e4ab016c8aaf8aa2ec4230eed6e4b36a1676a959ef788238342a47673e2e2785006006a4f4552ebf9531af46f520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
772b79daa7251857631553008ae8dcb8

SHA1
4626550afa218b4a145273e813bc20833d9d92d6

SHA256
3d50ca140ce5beaa2871324e9bd217f9cc8b6118620a414cca372091b32ddb9b

SHA512
f86af09b6f06c80d88ce69ed290c57048c102f886dc77733caaa1f4e2de9c1fa6d8f2fa26a4d05979d29542f8975dde97509841d220832827025d98ed069567e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
402B

MD5
cffe9f982111a406d5a998305bc2744a

SHA1
baae9bbadb66ac1032eefae26bae3ead41797725

SHA256
2bbccc043fc2c20a27a0102d77605d0c1c2fdcdd4cfd617f91ca946d59094243

SHA512
f68efc65b369806f5b68eb1ff7f5505072c91446167f91f6c6c3255abf1beaf48b164a21c2e409722049fe98e877776693166eb70ae2baa16203311395eabff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_3D61C5DB88562BC5E38E0D66E2932BCB

Filesize
406B

MD5
1f54a7fdff36c3e094ecdb2893f9c5d0

SHA1
213e88f6e847b40d5280aa31354b91acac3b763c

SHA256
9e6d77a618f2d99c867153b913bd32334e0bef49cad35457d14b44a4c60f0698

SHA512
1062fa92aadbd00cffe7eb71f875f191971b4a0b9f4e2972ef05e1e8e41822abb7a1f529daa12e4e8542a10ffd3d21af29c741400fef83f493aacb16c6afca55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
406B

MD5
4affff11812c1a046e640eb777297a28

SHA1
2a5060a5f9322790a9627c5d0b8129bc29475bd8

SHA256
1e01a3fee6b005a52f8b4aefb54507bb444cd658c7f5eb3f6ce6156bbb555b4b

SHA512
fe635c783c0bd8629bacdb5d759b256a3be234574691af60cdb636d5bf31d34234a9c5c40e5eb8dd8cfdfee1fdcb4ea55865a6d434a0b0a9b0ba4a080e0a45aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
406B

MD5
29a62a194534f09ab3fe3d106587a7b0

SHA1
ad28ed30114d27d68a0a96852de78b366b4054cf

SHA256
233cbf0d2d1a35bca7333faf9b3dc79ed1a0425c6d58e14ec1a85d8a8bee5e23

SHA512
83d099b5c99ac616092466e87717f9b8f5dd6dc44896e24b275a8c686aeee9577771b96cf9dbbc693dfc449b2f9e14981fe7c540bc31f01a67979c16d59c59cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a2c8f4c836d5ddae03f81a7aa7b5a823

SHA1
4a0504c27b4bcfffaeb2aa47c19945dbbe6e2ced

SHA256
c11b05bbfe1beecc7f2d1698ba5a362d12ef019a105c8fcebb00ff6d821a8869

SHA512
780139ceda3231575d961ec5cf9d372424eb146b13a67d4c5219abafc84b5a9d396173456f6da9ccadd7cf0c9b064b77c419f675ed72fb078876949453871291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
aec7a7b3d9289385714ab448dcdc7bbd

SHA1
986d45fbc7ccab81d9f4ed3cd43478850769cca7

SHA256
9d4996a0eb871f94aea5a65287c58df35eda3c9df0a4cd7833436a849e05c5d4

SHA512
ab23141cf57fafde12e0ad506d60c6dad4035977f330ff63bdc7f87710b05aa846174aa706e1865072eb5d9a467121edc40972b80d3b9d058a3f2bd04e6457ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\3LU9TDEJ\www.hugedomains[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FSXR9DP5\www.google[1].xml

Filesize
98B

MD5
259dfaf970f22960a22bbc46b10a1cc7

SHA1
1f3b81bb1c1c01502008ab3390af76b94d7d4c83

SHA256
4d188f9b8a21786a0efcc5bad19f1864fc5fbece76a4307218fa8f593615e4f1

SHA512
4e1373511e3f1f7c36af74a5c4af136f89b50fa69b9e37d20c7a5434b7e1a9ed5c635e1ff88a0248b9521d7b97e24ad751cddc40ea25dda589ddb8b194562701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XB6YKGN8\recaptcha__en[1].js

Filesize
399KB

MD5
b2507198388fcc94ca9e94ed4c5561c5

SHA1
8853fc86f1c616bd20a73e3e24442036fd90fd2f

SHA256
02c7565a86d6d3a80295b85161d78fc88d8c79a0e314c0c7777570237a365ed0

SHA512
9461ec9b79eaf72e85744d4fba9f18b3d3f1f9b3fb28f30fc2392f5740e21eb11a73f15700e4d5c4af9f2b582c4efdbb8d3492d4a14e32a1e8715458c9e464d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\86W3A17W.txt

Filesize
431B

MD5
e15c1b7cf6694230fba518d75e1973f3

SHA1
1ba4abb412584cb3a077229dc4a85275ac66750c

SHA256
48391421c25fdc79a65b1cb3c9a1b1c06afe90f8ece86b801a01af2b24ff8065

SHA512
3152a1c93eba2de5ca4f75cffb6a4368a90e59c05c0555d031cb5a3e91d177a9744ddb19252512a7a6b808fd0d44b8cd636ec3ee0fa470735f8efa05a517b46f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QPF613H0.txt

Filesize
181B

MD5
edf28244e9c1b87e0609c6ab0e04cd1d

SHA1
ccb774eca7d6109d676f51df1a4935dcd2814a02

SHA256
2d66ad83251d771c0a5fdbbf436fea1a75a7fcae76f034ef5a12a6d8794b19fc

SHA512
856c04bae1429a4591e7c037df9655c54774e27d814a711735df1cf273caba9d2e87eacf442712b38133184813d88234c741fb57032e63850ef3cce76ec0a0d8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
833KB

MD5
ef340e8cf4f94565b1d75b56badb3b9d

SHA1
e9c8892e1978d20ad65398bfa873afac3d937fa7

SHA256
bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

SHA512
5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
833KB

MD5
ef340e8cf4f94565b1d75b56badb3b9d

SHA1
e9c8892e1978d20ad65398bfa873afac3d937fa7

SHA256
bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

SHA512
5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
833KB

MD5
ef340e8cf4f94565b1d75b56badb3b9d

SHA1
e9c8892e1978d20ad65398bfa873afac3d937fa7

SHA256
bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

SHA512
5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
833KB

MD5
ef340e8cf4f94565b1d75b56badb3b9d

SHA1
e9c8892e1978d20ad65398bfa873afac3d937fa7

SHA256
bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

SHA512
5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
833KB

MD5
ef340e8cf4f94565b1d75b56badb3b9d

SHA1
e9c8892e1978d20ad65398bfa873afac3d937fa7

SHA256
bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

SHA512
5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
833KB

MD5
ef340e8cf4f94565b1d75b56badb3b9d

SHA1
e9c8892e1978d20ad65398bfa873afac3d937fa7

SHA256
bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

SHA512
5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

Download Submit
memory/776-100-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/776-91-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/776-92-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/776-88-0x000000000043AAE0-mapping.dmp

Download
memory/776-96-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/776-87-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/996-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-58-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-59-0x00000000004176A0-mapping.dmp

Download
memory/996-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-70-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-62-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/996-65-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1300-77-0x00000000004176A0-mapping.dmp

Download
memory/1300-85-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1300-86-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1344-68-0x0000000000000000-mapping.dmp

Download