67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8

Analysis

max time kernel
147s
max time network
156s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe
Size

261KB
MD5

c26f273b1bc17dc723943c9dc15bed32
SHA1

ee6fbae8be4aef7bf6608384728bdf57ac03a3c6
SHA256

67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8
SHA512

812441cb8b05b7f498bcbc0c152eaf012ceeb53d20c45b60f050b42735445f9dc8bc12492d59c9dfb82311ef6d791cf36723d3f25333b83b9bab07ce6b2419ad
SSDEEP

1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-37693893"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-79921310"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-17543870"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-62240766"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
2036	winlogon.exe
688	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2002s902.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalarm.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naveng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netscanpro.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exit.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscanpdsetup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamauto.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GenericRenosFix.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jed.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wgfe95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\norton_internet_secu_3.0_407.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icload95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsys32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\offguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2servic.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azonealarm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsysnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccclient.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpexec.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122e4-57.dat	upx
behavioral1/files/0x000b0000000122e4-58.dat	upx
behavioral1/files/0x000b0000000122e4-60.dat	upx
behavioral1/memory/1348-61-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2036-64-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/files/0x000b0000000122e4-65.dat	upx
behavioral1/memory/688-67-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/files/0x000b0000000122e4-69.dat	upx
behavioral1/memory/688-71-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/688-72-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/688-76-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2036-80-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/688-81-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe
1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\54156435B4E49525 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\54156435B4E49525 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 688	2036	winlogon.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Sound\Beep = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Sound	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1059"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1207"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1186"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802f35bb8c0cd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1071"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1038"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2000"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1979"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "218"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2859"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1038"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1104"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2daf1225aafda4da47579487e6bef0d00000000020000000000106600000001000020000000b88e1dc31a92612950b08efacee5de4feb2753d4e10a86605551ba374d6cf874000000000e80000000020000200000001cb402e1e5773493fe06458764d38190a080384c81c5fab6034627cf36b25fcb20000000a9b68499514591b86bfae85554f9248fdecaece89db96d8021290c4c0decc22840000000bdfa2cd3d3a8ddbaac1f0b3157408d29a6a583ab99552f4e72a838a8d795b77e8127b88094227d0192f9b4482700348555789b122a051025351db99a9b049156	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2012"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3028"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "27"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "303"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1186"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2012"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://655nq9j6e0nh957.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2880"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "142"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1192"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1192"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1071"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8531"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1213"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9532"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://n6zk7ajz2y7r953.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2094"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9553"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2daf1225aafda4da47579487e6bef0d00000000020000000000106600000001000020000000dee1e072239e9be8817d8ddf81255bdbed10075579ffeaf924ec77bfca59c995000000000e80000000020000200000000ef22210f1fdf4594cefeb1b5647b06c32aa552a5cb4c5558238fa945698d1d5900000008338a2d5efcc37a01ea3df9f06669d9f0af7f74f56f4e7c5272a31c6586b88732b2e0674fb305f376703ab8b8c87d6e4f824d4aef47d5a17af155552bace33c99fbd96d6a210eac05a1f70336c81a65b8dc1b85b3b50b09d710183c08c86fbd6bd57b00e6c552a1d174387156a1db313bfc0082f30a3755f541358007037018a439e2dec95300d913cb938727e7e46e040000000a0c45832e53d2fc3094921ca0830d4127f77ce1991e3fad7866fcdb89b9489d8d25d1dcc86fe8be56e019d86c33f02a47b16e04e2b46c8b71b8727a1812529e6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1125"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8510"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://fka8h1o228140jm.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://630xv18648k4xh8.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe
688	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	688	winlogon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1556	iexplore.exe
1556	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe
2036	winlogon.exe
688	winlogon.exe
1556	iexplore.exe
1556	iexplore.exe
900	IEXPLORE.EXE
900	IEXPLORE.EXE
1556	iexplore.exe
1556	iexplore.exe
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2036	1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe	27
PID 1348 wrote to memory of 2036	1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe	27
PID 1348 wrote to memory of 2036	1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe	27
PID 1348 wrote to memory of 2036	1348	67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe	27
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 2036 wrote to memory of 688	2036	winlogon.exe	30
PID 1556 wrote to memory of 900	1556	iexplore.exe	32
PID 1556 wrote to memory of 900	1556	iexplore.exe	32
PID 1556 wrote to memory of 900	1556	iexplore.exe	32
PID 1556 wrote to memory of 900	1556	iexplore.exe	32
PID 1556 wrote to memory of 1628	1556	iexplore.exe	47
PID 1556 wrote to memory of 1628	1556	iexplore.exe	47
PID 1556 wrote to memory of 1628	1556	iexplore.exe	47
PID 1556 wrote to memory of 1628	1556	iexplore.exe	47

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe
"C:\Users\Admin\AppData\Local\Temp\67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Sets file execution options in registry
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:2700310 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e971d9322c1db42a99fe6181559614c7

SHA1
298a39d787d46d3691db2684b6b3f61b95fedac3

SHA256
3f4a059fd81412a69ae3315824b530c5d8192b696b1c68dca60e2cc147dc2b67

SHA512
6bf6e5cb03693166b2158c955602cafaf68700445a1053aa634ec1694fa67626952f6691be971754fe7d1e3e101f89960f96d52904f6bb1b90202bed50a718f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_937B8E951EEA7B5C55D8FCF23553A260

Filesize
472B

MD5
314ee1785b0411c9e3dd2bdf612e75c4

SHA1
35624662ce130c599eda672cc258386f6af86628

SHA256
d319c8ec9fd6e2fbeebac849a25f570bc461b4f9a461f502ee0c1ebbc19a9136

SHA512
ea070a0553a4d312300693d2d2291331a3ad257254fca68cd5436847890ba0c2d65c0fbdf7e6b37b564074998d778919bdea2f0a2349e73b06a01ac538e24dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
eafe84b1713f8c2fa37ac968ce354cea

SHA1
30d52d4e6388145a82de0c161b15a746c4ef57e6

SHA256
cf915c0980672f9c3f76f9bd686b3ff1655e7b2a03b7237bd2a04204f9bc86f9

SHA512
d1401fb22ac99b3254c88b753fc09e9f0789abc3676ce7df0ef009de8fb628153d974b261d4f4992293cf423541c46c059e8476729397a91c0d529ecb07fb730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
279B

MD5
eb9759a331dc4d80d8e45bb2f4fff750

SHA1
357c6488117ae3b9489d85b33077393bbdc0c77b

SHA256
86e8fbf7b808752b4c0389bd0cd2b80ae8396d2db5c8129c835c1bdcda5800b7

SHA512
1bd1c29e9d7e9b6e5aa82fdeeb6c333314626143eb008ad18fdf6b0f7bda76144f514b1dd17f54b60f073f799adf494ecf1c609abb206c12b84c7d9e64357ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_7E18DD34342A71CE2881EBE142FB96AA

Filesize
472B

MD5
5496e18a30e039b44989d9a0e932d4bc

SHA1
c5bfb1b9ce711e38d69e78486017f07cc47fe04a

SHA256
26a3ad286e479cdabfcbb5a9d3fada211c73650628a35c80944b0e7e8aad27e0

SHA512
d653c7380c201f3e1028217e50806eec9309dd9e1d2bfe78ace8596304a8d7f38b6e1fcc47ac74ddb154242dfcbb915c27fc25eb605b9b611b7228bca969b256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_1F9621DB6ADF94C2E3A651910DEE5D28

Filesize
471B

MD5
a49ab5ecc317aa7e4724050053737549

SHA1
3ffff77715bf8c5dbcbb5e17abbbc2c683c36f60

SHA256
844f25237f9906c3fb977d58259e132c41dacbbe546adc8b45e9992e6ee711c0

SHA512
5fb24b25e1319a871c051362b02facaff068ec78dbda93973db37db8c0503d1443b58601ff734e15389851c2ed4a6000c3f8478b11c8ac7b64d5324f9a7c6d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_3BF35504191E4275C8C2312B8FD77C33

Filesize
471B

MD5
f7aef7109978f8c1c53298563756a403

SHA1
d610bb812b080710945dd47f9cccd794af9fe2f7

SHA256
6366bc97e3f9ac9a6e8a294da60f2d961d2106180fd8ffaae97bc82ea399edb9

SHA512
44386cf9c066cd43e9344d1f1fb4bf227971d35d5bc7774902b354a4ce01102df0004a0a8b42e30502efc705e0ac1b5fa5feaf86f98f01021d5e2073e04c688a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_5A5B4C479F7E54358EF6DFEE665BDF07

Filesize
471B

MD5
b658d05e796c732572cbbb288f9dbd7a

SHA1
66c489a55cdfda30f31c88dd4fbedf1ee138229f

SHA256
f34d9a993edb309ed27889ac25679317ac691d7ca129aaf0732033013478df0c

SHA512
180e7d50e2aef14c3af478be15713bf621929be75d049014db653f2588a54e1153c12a3a778efd699df9fddfbb00926298ebf03420b1eef469f37c546d96f295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
d32b269a22a2007a914b24adfc480353

SHA1
d6232d22b3e626f16e540fd93cb1a6189301d6c9

SHA256
b0733fef42c637b7964cbcf1c93776f3fc33472dbd1d6312afddcb00e52881e2

SHA512
9bcacab078977c5d4c5d179a8c89daea46fd9b8392218a6d440dd7874c9d8a6eea79af499f5f4b107ef62a7d76e901c04c69cdb0e6ee89081989f0a241408d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_937B8E951EEA7B5C55D8FCF23553A260

Filesize
406B

MD5
5559bebeea0b0cd035f248cafa67699d

SHA1
34ad8e7d57ea4c98e417be8f716a2b63cadafb2c

SHA256
6df32bd27aec907da781163499e5b5bdf1853704629e6b628d356a02a5c1604b

SHA512
0f747dcc07e435adc10c13c10ccdfd1d54f5a12ac6eebac2034f2dbe30927e9aa2d837e0bf0860f5ef61e543886ebdfa0b8ae2ba8427471cdc29a9c58fd485b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
b12fa305233e9da7d8f4cdb0142e3584

SHA1
1d3fe7ce9cc21354e65f5e7ea1dd2abc4ba70b0e

SHA256
c81b4870f7ddbdbe01b742a29b666ef6c2cd6f0780c5cba068721a2a9fdd6870

SHA512
fb908a0b18d5584b84fd7301c51c218bef30d475f9b2c7d7b9d43ab3b91fbc4a367b96389289cc03e1d7264800de8aba166e2428748213340a5a6659cb760dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47b70627adb1a549adb8f6a304f3f7dc

SHA1
e627f84a13dda8bf98e9b60edd80c7144e6c6349

SHA256
7ea1dccb6a733111993a301498e409d4c2efb5e84af4f56c4eff2bf3b23ae930

SHA512
538e779943c4459352d99266b7f5bce56a7a3f1d111c30e94175355a3c6df2707388cd31a57131d7224135568d0bc628413f1292836424d23c6f39da6ef4b4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0837528c01306bee92dd58bc97079c

SHA1
73f6868995ad49074b8f8fc89679b1d28d3300ba

SHA256
e69f50902e1237f0a1ade5dd6fe2d78d9174c410ad8caf82e9907b95a096bf8e

SHA512
3fc5a56646d1eb8adb7bbfc4a36806e155385843315cfb4591f3eb5a90db95ab50f02399eae301197703f0381655f54a9da1da3ba083361c21b2d6dd6d1fc0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a57229d27bc538d9c18a871f9f3a168a

SHA1
6d92e8a39a2776e44c87468c43a11a9998df3fbf

SHA256
9a592c19cbb68df5f39da20700a8c9bf186573f12789a205df5180d303d9f42c

SHA512
86acfedb1bea9a4c9e9861d37f0a08e5fc68975e86a58696a9ff4bcdfeb19357dbf772a39a3d19881d66ac172ee1b36c449a5d11ebe0f2fddadddc54a4395a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df7f1e36f16e209874fbdd1425864ff5

SHA1
55fb00069d953c3aa0110c395e92095b2d57e499

SHA256
8b0c5065ba94353fa0c82a24b97663e88a85bc606bed198fd0fb4149769188ea

SHA512
8447874a1e5aafdb71eee0021a6fa655ab9f194b6fd55f870153ed920a4922a85f203abd6295f3539d0df5b2ce9b088034172cfc5565e7e4b39f60fe16c76ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
513bb52d7487487b9de1d529f2f80cf9

SHA1
0549fe23e604373125af1617a0cad5060ad0943b

SHA256
5c3bb9ad099177284dfd959eadd6991f2eb41f19b281d4cadcd5c4cf7390377e

SHA512
82bb9420c33a99ece0abef01bb99acb55edf2c03ce8e13994e1de2966824942a7b33d50f2f0b5e8ef79da956810ae0cb7710f760a9189e1764c27521add461a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
426B

MD5
3bc9ff7e8d52cae085df7d05d6ca0d26

SHA1
ab46eea88a6d3ddd895d626d435adbabcdc0a456

SHA256
27d4c8942b2dcf82c734726756bc6669239315f677710d09fa70bed0bf24b83b

SHA512
4c4a0ce9ce8c6f59a6f0dca6d5687b3f4fb9c6fa99e11fee60d94fa93188c38f0e24688fdfb884e3e62c96001cbed502933ee8b19102bd1ee1c3d0ecc4180d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
690906b483fc88e7aedbb0ffeb52fa46

SHA1
f52b51405908c42228042ecc02a2cbf61c0030d8

SHA256
684e19044b61e2518c0b4193b2b1fa192daeda81863a99a86282c94a51d98907

SHA512
d0577370ec6710709ac2e084c0ad3afe8d4a2106fd355f57683725eb31b976c0c9b7a3cba763ec69c2419a6fd256dfb4a2ebbaaceec20c7d170f1dbe3a1644da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_7E18DD34342A71CE2881EBE142FB96AA

Filesize
402B

MD5
8e8b9d002ba65881a276a30f1b88b9cd

SHA1
7f2fe923911b31db5b0fb1f3457a6f636755f2da

SHA256
c34bbf1c0198e50e92ffbe45a12ce64fda7907508b2e04bbde1b83ca61477f01

SHA512
de0010cf1b65f0c21e532beb5b4939898e2f4b4facfb8f3b92f4bb0ec74e29123110c5d206149b7d00a829f5bd86ec85a113b62cd7d3bfe219186934a36dd620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_1F9621DB6ADF94C2E3A651910DEE5D28

Filesize
406B

MD5
5e79634a9ae9a16048814021f414528b

SHA1
0d951f9940eaafec1b3661c448cf82323832fea7

SHA256
e52eaedbcd3a09d2547d1a331cab0eaaf6413b441946d581b6803e401b49beaf

SHA512
61cbb6150d5b16a2ae910e2fbaa6a443d9052dbbeb1884769c62fd5d351a940d87c7192781dd77320e8cdab3531329a980ee68fc00546af8340605703f7c03d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4c907bc6a75e90dec304631bb2532965

SHA1
ab5fd1cbbc2d7f3f6b19fbe9621b34a62d705c2e

SHA256
bfc60156a892fb37c1500c11d43eee8687edbedb92893dd8151b2fac4161efcf

SHA512
b081a9de9b8a1506113d6181b52e265d1720cf9c8a44f83fc3d00dda7c4e4b9d060fd9f9afb5e5c81b302a07c8ea5edc056541607cbac1e8cdd5bd423b89080a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_3BF35504191E4275C8C2312B8FD77C33

Filesize
410B

MD5
60163ddd1bc9bea6110fcfc8a50cb9b6

SHA1
34e4cf40deb87c3e0a445eb5bdbf6d14a3d6f611

SHA256
76698b09105c86ca33591f7ee4995cb0afb8cfb6bbdd1a207657e982ceaab396

SHA512
e575dd680b8ba5b9c5cc58411c965ffa24d21e72556955c423c60cfe83be4a577b4026009f45aa8f8df5bf9cff142086afb9d8a20f09655df4009f81210db166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_5A5B4C479F7E54358EF6DFEE665BDF07

Filesize
414B

MD5
0cfcab882c45207dd48152934d00854b

SHA1
d30fdc94d90cd83b3ba3580610fdd072fbba1cac

SHA256
23632f06cd6b63360ddb59270ef37c2630694d361c67fafaab1615bca13e907e

SHA512
28b36e9abef889bb486c0b9778b7dc5dbdc9f131eeebd57549b882530ce8a41e5523bf4f172ddf3806af4973ba002ff05912e09824727d448ab193a1ad126935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
bf97cc5e33105823134c404513887768

SHA1
355b9d3703903d72851a7d30e47bfbf293ef8490

SHA256
495db5b7ac7b9496a9b83bc3d2b36c65c4902f08da77a8a1fbde2abfcba6c834

SHA512
1d26ebebec86af492bead566840b9c93899b6a96a7960eade935ebce9655793c36ebaad11c271c90244ade7485001c8b692a70015425afa07a2770429130f7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXJIW9HP\logo[1].png

Filesize
4KB

MD5
c6585d35dbe66427d2971405193e3420

SHA1
88f0c9cc830f31e475aa5040a44c959b6e5b309a

SHA256
b7538e415e50685e667d23705f5513c5770ae627e849bd1ea3c98f5abaf336c8

SHA512
0042ffe3ee3c8b62a7f9c58de72f8c27730a993f423a9daa32864102f8621ff52111a8b8f55b5e882c6e338ce3da7a4c1a46ac9f621b53c8aef95bc7e0d881e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXJIW9HP\phone-icon[1].png

Filesize
743B

MD5
bd361461dbc83db995e644e42e59dca9

SHA1
7d3d5350646382e10d1fd84a3489d2eec7f1c651

SHA256
4e5d6e60573346e0eb3e8368ca629af38d0d59f4e51f750724e7f95f8be5917e

SHA512
8b09cd2f95cd9e50a04aca3a57942e565556cefd65d6c903321a45bf4d746f48ca3e0785f2330483a0ed52437631d9bb086e958368c3da44b4bcf3314bfd0f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXJIW9HP\responsive[1].css

Filesize
63KB

MD5
71c2751b4fc2bdd14c9ddb960f45a3f1

SHA1
2ff12cf4611d1dd6b3b9a1260900a5c2f88eb472

SHA256
0fb69e11495d2244539725a723358bd6aa59d242986f8b6aaefff070b698dc40

SHA512
1eac711937cbc3629a280de0290f270102ca22f3d897c328fd410ee7e8134e2a10647681bbd6e8f6ce5a8c1000093b0ca4420f56c9018d79c80232b699ce1c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAR9OKL9\care[1].png

Filesize
708B

MD5
3ceb91c3c875ca5750c7aadf7e4ece6c

SHA1
041a428a64ee9d32d6da4befacf6d8e5e3f5e436

SHA256
3ec2212fc76e58ec342024869548e63c5a954162535572610a184aa0690577c8

SHA512
2638d74954ce8fe60b66fb9b6222b41660014426b0ff41accd110191e206764e0967a253d348a9a24417eefa6240ab2d3c50eebbeccb1ce484f359be484518c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAR9OKL9\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAR9OKL9\script[1].js

Filesize
9KB

MD5
defee0a43f53c0bd24b5420db2325418

SHA1
55e3fdbced6fb04f1a2a664209f6117110b206f3

SHA256
c1f8e55b298dc653477b557d4d9ef04951b3b8ba8362a836c54e2db10cda4d09

SHA512
33d1a6753a32ec06dcfc07637e9654af9321fe9fa2590efc70893eb58c8603505f2be69084fb2bcbf929218c4e7df9f7a8bc3f17a5b41ed38c4d8645296ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z4TAQ562\api[1].js

Filesize
850B

MD5
e792e5060348c5f2109c7465b6f3d5ba

SHA1
5e0dddac930eba2a17da649e296a55720ca79f0e

SHA256
fc34f6b93e882a0544fce4e86425b8d16ab852004aa232d29550c9afe9dbbcc4

SHA512
c260b11fc05cdc0b9817499ae5bb4616fbc3b118982255205d3f5e665e089ac08834d3ed925c1e6fbbf40c0140e50e7498836bd92219dc7536ce3fe9b539efeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z4TAQ562\domain_profile[1].htm

Filesize
7KB

MD5
344f57687c4a4858b403790b1943ed6b

SHA1
47039c86607d0599bf5bb969732ea91e70d0958a

SHA256
caebb831d381e5a102f110161423153c9492cf4e299f43bf2ec179abbe3c3e12

SHA512
e1fe37902e4226d13969f939624d2440ddc57a7f90432ba3611106ddc25fb24f6e3613384f034b030982eda40302efbbf406b95246803452bbb6012ee7803c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z4TAQ562\guarant-footer[1].png

Filesize
1KB

MD5
e527bd653c6ab12a65243ea7b6090d60

SHA1
6f4cecd8c8d38e340a81295606d4faa28d34d0a7

SHA256
397380d4c94183937f67dc28fc89697fadef075f66e637080ec71545b07d65f1

SHA512
9896c83694472a6bfa82c34c637c59db24d04591027df55416bd070b223230976d129d12b1d69618b6039a3b4e25a8cc9f79ad27652ec079ac80801eb7a596cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z4TAQ562\js[1].js

Filesize
108KB

MD5
2a58441c9841c7e6a4da22e63ec202e6

SHA1
f4c8ecefd7829025ab5c016d40bf69257ed3e8da

SHA256
3e2918e8b829cf536a2e0b2caa4c2fc000c8a40ad373f4f850fe7fc290c76d56

SHA512
39ef3271e6595ee9bc1eed2f9a1101495ffdea7ba918f8cfd9bdb1f73a5de6c7a69c8d960a90a3b19525b2d9b27625be6538585b2d6427575d8d324b877c069d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z4TAQ562\style[1].css

Filesize
158KB

MD5
9b02e62faf032ecb47560c0944d2044b

SHA1
5c2283710f83026d0117c1d31567926c991e3c70

SHA256
59190ed4208b5f4bdceb308020c144225d80d82c6436d7b9afd920c87c3315ef

SHA512
c0ba9272e90b46fc9b66f747c4c49860e255f454604e7ee4b7cca4a9e29a801b0e85fb12086ce9b9dd5fe710960ac6ae023e1587c3d5ab6c31d1cf5f124becb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\escrow[1].png

Filesize
2KB

MD5
5e3fff838a9aa2ef46e2e4d9fe13ab85

SHA1
a6ea4b142dd129e28d02ecc0dc59edade1976376

SHA256
bbb3555394a1e45cb61c59281716bf177f29a026efef4750eed9c8a21b838765

SHA512
af1bf6100980f0af9243c24802fa904350193e9f31d5f43cab779e17f03fe2214cc32a6621a1b5110108131d7a6aea5d68c4c6d7f04ddee278ff9da026d2f3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\geo[1].png

Filesize
2KB

MD5
1aceace0b63ef3e4cf3a349b83f5725b

SHA1
fede44a511cbb7a94be77c6a3fbaf05c0ac735e9

SHA256
7185ad18f6d3ea3d12c0a64a084a4bc570ba2e79ed46a1fb3427a4c29ca9bb20

SHA512
6f1c7357b7cca38c3fa5fa6cc8ab4171d9b8522eb77c9ac814102a2b4711f021a6387706ec8f4da8d5c199498c4695e7289ce647373451b4d60b755fd8af1ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7Z6WTJ95.txt

Filesize
547B

MD5
c6ddcd9f2558d671f81563f2f798102b

SHA1
cc39c909ee9ef30227d72460ba9548fc48e1ddaf

SHA256
41b9754e7f5ba99248e1e2268a9fb05071e1a78795c2f9aa37713129e8f823be

SHA512
8503df51549b8d4cafcaab13e9de00fdf0a6bdad814c5ab97481b71e913660dd19573eb9882ba8279b719a7701670c0479ebede6c8c1d6b1caa65f9d6ad06fea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CG0T5Q7Q.txt

Filesize
183B

MD5
a2a86d3abf8ff44c56356d92d89f5020

SHA1
3fba5d54cf7c3ec4816ec551f9e09eba49dba1b1

SHA256
2f748a1a404f4a2b1fd4b5a755d21bdb7575b47debc71de0f7ada6e575a205cd

SHA512
50b0a512e021e44ed0966be151f641ff7bbba345379e395a4d6f7565203fcd6aaa770f9f4ebf1d4a72833198f1e028e28b025b1b77c4145df3eb063e870d549d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SPM4YOGC.txt

Filesize
496B

MD5
78183faa3ff416fe7351b7c0bf71b312

SHA1
21c10e3a36364826f83e68666a1912ac6d665511

SHA256
f566c8efdc6e5f31917b1cf55b745148d16c0d16376c0353cf2d1e7fbaf9e7a1

SHA512
ec253b9bafca6c3dcd52e28cb002d3c5ac05ad310b249b69e920719a80f7deec9b013e0eedbaa5a80cf31f52477c669dd2ced47c637e0e54a972c1f4665f4397

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VU2L2PPM.txt

Filesize
608B

MD5
74a44c7d5fdd57dfe2099ac2732d4352

SHA1
54ab838858318411afa6e2e169456b50b98e8903

SHA256
26f847d07be1c59975717b7430b3879092679f6f282e8547d664f5809fe98f9a

SHA512
40e7cce5b2d0b1ade562b52d60b3c324e76911cf3fca324d0a12560b79fa9072c47825dfd1eb07560fa02cbb32ace9754017d9de5a832a150a125171bad0450c

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
261KB

MD5
c26f273b1bc17dc723943c9dc15bed32

SHA1
ee6fbae8be4aef7bf6608384728bdf57ac03a3c6

SHA256
67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8

SHA512
812441cb8b05b7f498bcbc0c152eaf012ceeb53d20c45b60f050b42735445f9dc8bc12492d59c9dfb82311ef6d791cf36723d3f25333b83b9bab07ce6b2419ad

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
261KB

MD5
c26f273b1bc17dc723943c9dc15bed32

SHA1
ee6fbae8be4aef7bf6608384728bdf57ac03a3c6

SHA256
67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8

SHA512
812441cb8b05b7f498bcbc0c152eaf012ceeb53d20c45b60f050b42735445f9dc8bc12492d59c9dfb82311ef6d791cf36723d3f25333b83b9bab07ce6b2419ad

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
261KB

MD5
c26f273b1bc17dc723943c9dc15bed32

SHA1
ee6fbae8be4aef7bf6608384728bdf57ac03a3c6

SHA256
67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8

SHA512
812441cb8b05b7f498bcbc0c152eaf012ceeb53d20c45b60f050b42735445f9dc8bc12492d59c9dfb82311ef6d791cf36723d3f25333b83b9bab07ce6b2419ad

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
261KB

MD5
c26f273b1bc17dc723943c9dc15bed32

SHA1
ee6fbae8be4aef7bf6608384728bdf57ac03a3c6

SHA256
67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8

SHA512
812441cb8b05b7f498bcbc0c152eaf012ceeb53d20c45b60f050b42735445f9dc8bc12492d59c9dfb82311ef6d791cf36723d3f25333b83b9bab07ce6b2419ad

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
261KB

MD5
c26f273b1bc17dc723943c9dc15bed32

SHA1
ee6fbae8be4aef7bf6608384728bdf57ac03a3c6

SHA256
67648da5e6f9ba8785e5eeaa2dfbf6d75d7ce87e04ff554f0670fdbcb705abe8

SHA512
812441cb8b05b7f498bcbc0c152eaf012ceeb53d20c45b60f050b42735445f9dc8bc12492d59c9dfb82311ef6d791cf36723d3f25333b83b9bab07ce6b2419ad

Download Submit
memory/688-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/688-67-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/688-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/688-76-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/688-81-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1348-61-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1348-56-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/2036-64-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2036-80-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download