description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\userinit.exe"	h2s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\userinit.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\userinit.exe"	nacl.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	h2s.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nacl.exe

pid	Process
1676	h2s.exe
1680	lsass.exe
1732	h2s.exe
1740	lsass.exe
1068	nacl.exe
1064	lsass.exe

resource	yara_rule
behavioral1/memory/628-56-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/files/0x0008000000012304-60.dat	upx
behavioral1/files/0x0008000000012304-65.dat	upx
behavioral1/files/0x0008000000012304-87.dat	upx
behavioral1/files/0x000800000001230b-100.dat	upx
behavioral1/files/0x0008000000012307-99.dat	upx
behavioral1/files/0x00090000000122f9-107.dat	upx
behavioral1/memory/1740-112-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/files/0x0008000000012307-118.dat	upx
behavioral1/memory/1680-120-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/files/0x00090000000122f9-124.dat	upx
behavioral1/memory/1064-127-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/628-125-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1068-122-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1676-117-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/files/0x0008000000012307-113.dat	upx
behavioral1/files/0x00090000000122f9-109.dat	upx
behavioral1/memory/1732-97-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/files/0x000800000001230b-96.dat	upx
behavioral1/files/0x0008000000012307-94.dat	upx
behavioral1/files/0x00090000000122f9-92.dat	upx
behavioral1/files/0x00090000000122f9-79.dat	upx
behavioral1/files/0x0008000000012307-78.dat	upx
behavioral1/files/0x0008000000012307-73.dat	upx
behavioral1/files/0x0008000000012307-70.dat	upx
behavioral1/files/0x0008000000012307-69.dat	upx
behavioral1/files/0x00090000000122f9-66.dat	upx
behavioral1/memory/1068-129-0x0000000000400000-0x000000000048D000-memory.dmp	upx

pid	Process
628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
1676	h2s.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pikachu = "C:\\WINDOWS\\nacl.exe"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	nacl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pikachu = "C:\\WINDOWS\\nacl.exe"	nacl.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	h2s.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pikachu = "C:\\WINDOWS\\nacl.exe"	h2s.exe

description	ioc	Process
File opened for modification	C:\WINDOWS\nacl.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File opened for modification	C:\WINDOWS\nacl.exe	h2s.exe
File opened for modification	C:\WINDOWS\userinit.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File created	C:\WINDOWS\h2s.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File opened for modification	C:\WINDOWS\h2s.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File created	C:\WINDOWS\system\lsass.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File opened for modification	C:\WINDOWS\system\lsass.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File created	C:\WINDOWS\nacl.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File created	C:\WINDOWS\nacl.exe	h2s.exe
File created	C:\WINDOWS\system\lsass.exe	h2s.exe
File created	C:\WINDOWS\userinit.exe	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe
File opened for modification	C:\WINDOWS\system\lsass.exe	h2s.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000087554f14102054656d700000360008000400efbe2155ef6b87554f142a00000001020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c60031000000000087554e1410203042313538327e310000ae0008000400efbe87554e1487554e142a000000fd2201000000080000000000000000000000000000003000620031003500380032006500370030003400390065003200380065003000300036003700640064003800660063006400320061006400610034003600330036006400650064003500640066003500340063006500640032003500300035006600320038003500320064003900360061003800380035003700630062003400000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c0031000000000021553c78100041646d696e00380008000400efbe2155ef6b21553c782a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000002155ef6b122041707044617461003c0008000400efbe2155ef6b2155ef6b2a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c0031000000000021554f6e10204c6f63616c00380008000400efbe2155ef6b21554f6e2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 740031000000000087554e141100557365727300600008000400efbeee3a851a87554e142a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe

description	pid	Process	procid_target
PID 628 wrote to memory of 1868	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	20
PID 628 wrote to memory of 1868	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	20
PID 628 wrote to memory of 1868	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	20
PID 628 wrote to memory of 1868	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	20
PID 628 wrote to memory of 1676	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	23
PID 628 wrote to memory of 1676	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	23
PID 628 wrote to memory of 1676	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	23
PID 628 wrote to memory of 1676	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	23
PID 1868 wrote to memory of 548	1868	cmd.exe	24
PID 1868 wrote to memory of 548	1868	cmd.exe	24
PID 1868 wrote to memory of 548	1868	cmd.exe	24
PID 1868 wrote to memory of 548	1868	cmd.exe	24
PID 1676 wrote to memory of 512	1676	h2s.exe	48
PID 1676 wrote to memory of 512	1676	h2s.exe	48
PID 1676 wrote to memory of 512	1676	h2s.exe	48
PID 1676 wrote to memory of 512	1676	h2s.exe	48
PID 548 wrote to memory of 520	548	net.exe	49
PID 548 wrote to memory of 520	548	net.exe	49
PID 548 wrote to memory of 520	548	net.exe	49
PID 548 wrote to memory of 520	548	net.exe	49
PID 628 wrote to memory of 1680	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	25
PID 628 wrote to memory of 1680	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	25
PID 628 wrote to memory of 1680	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	25
PID 628 wrote to memory of 1680	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	25
PID 512 wrote to memory of 848	512	cmd.exe	46
PID 512 wrote to memory of 848	512	cmd.exe	46
PID 512 wrote to memory of 848	512	cmd.exe	46
PID 512 wrote to memory of 848	512	cmd.exe	46
PID 848 wrote to memory of 1404	848	net.exe	45
PID 848 wrote to memory of 1404	848	net.exe	45
PID 848 wrote to memory of 1404	848	net.exe	45
PID 848 wrote to memory of 1404	848	net.exe	45
PID 1680 wrote to memory of 876	1680	lsass.exe	26
PID 1680 wrote to memory of 876	1680	lsass.exe	26
PID 1680 wrote to memory of 876	1680	lsass.exe	26
PID 1680 wrote to memory of 876	1680	lsass.exe	26
PID 876 wrote to memory of 1008	876	cmd.exe	28
PID 876 wrote to memory of 1008	876	cmd.exe	28
PID 876 wrote to memory of 1008	876	cmd.exe	28
PID 876 wrote to memory of 1008	876	cmd.exe	28
PID 1008 wrote to memory of 1540	1008	net.exe	29
PID 1008 wrote to memory of 1540	1008	net.exe	29
PID 1008 wrote to memory of 1540	1008	net.exe	29
PID 1008 wrote to memory of 1540	1008	net.exe	29
PID 628 wrote to memory of 1812	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	31
PID 628 wrote to memory of 1812	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	31
PID 628 wrote to memory of 1812	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	31
PID 628 wrote to memory of 1812	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	31
PID 628 wrote to memory of 1732	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	44
PID 628 wrote to memory of 1732	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	44
PID 628 wrote to memory of 1732	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	44
PID 628 wrote to memory of 1732	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	44
PID 1732 wrote to memory of 1796	1732	h2s.exe	43
PID 1732 wrote to memory of 1796	1732	h2s.exe	43
PID 1732 wrote to memory of 1796	1732	h2s.exe	43
PID 1732 wrote to memory of 1796	1732	h2s.exe	43
PID 628 wrote to memory of 1740	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	42
PID 628 wrote to memory of 1740	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	42
PID 628 wrote to memory of 1740	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	42
PID 628 wrote to memory of 1740	628	0b1582e7049e28e0067dd8fcd2ada4636ded5df54ced2505f2852d96a8857cb4.exe	42
PID 1676 wrote to memory of 1068	1676	h2s.exe	34
PID 1676 wrote to memory of 1068	1676	h2s.exe	34
PID 1676 wrote to memory of 1068	1676	h2s.exe	34
PID 1676 wrote to memory of 1068	1676	h2s.exe	34

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	nacl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	nacl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	h2s.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nacl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	h2s.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	h2s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsass.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.