604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

Analysis

max time kernel
153s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
Size

585KB
MD5

1843b7445a84689e45962d5a2f7239a0
SHA1

d2e62464eac5b43c701b1a48bf09a01b7c565dd1
SHA256

604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29
SHA512

d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805
SSDEEP

6144:NeHwXUU5EYCTvaBjRjWrLJKuKnGML5Njcxmu3ijWrLJKuKnGML5Njcxgu3hjWrLA:NyMUusvalgg5Njam8g5Njagxg5Njag5

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CIO0P3D\\LEK2S8C.exe\""	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CIO0P3D\\LEK2S8C.exe\""	system.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\CIO0P3D\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\CIO0P3D\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe

Executes dropped EXE 5 IoCs

pid	Process
1632	service.exe
2556	smss.exe
1976	system.exe
2236	winlogon.exe
3856	lsass.exe

Loads dropped DLL 3 IoCs

pid	Process
1976	system.exe
1976	system.exe
1976	system.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023125-149.dat	upx
behavioral2/files/0x0008000000023125-151.dat	upx
behavioral2/files/0x0008000000023125-147.dat	upx
behavioral2/files/0x0008000000023125-263.dat	upx
behavioral2/files/0x0008000000023125-262.dat	upx
behavioral2/memory/1976-296-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sIO2X5G0 = "C:\\Windows\\system32\\MHG8M4IINW6S6Q.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0S8CNW = "C:\\Windows\\DGQ2X5G.exe"	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sIO2X5G0 = "C:\\Windows\\system32\\MHG8M4IINW6S6Q.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0S8CNW = "C:\\Windows\\DGQ2X5G.exe"	lsass.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\SRV3D1N.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\SRV3D1N.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K	lsass.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\SRV3D1N.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\SRV3D1N.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K	smss.exe
File opened for modification	C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\SRV3D1N.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\DGQ2X5G.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D\LEK2S8C.exe	winlogon.exe
File opened for modification	C:\Windows\CIO0P3D\LEK2S8C.exe	smss.exe
File opened for modification	C:\Windows\moonlight.dll	winlogon.exe
File opened for modification	C:\Windows\CIO0P3D\system.exe	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\CIO0P3D\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\CIO0P3D\winlogon.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D\service.exe	system.exe
File opened for modification	C:\Windows\DGQ2X5G.exe	winlogon.exe
File opened for modification	C:\Windows\DGQ2X5G.exe	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\CIO0P3D\smss.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\INW6S6Q.exe	system.exe
File opened for modification	C:\Windows\CIO0P3D\LEK2S8C.exe	system.exe
File opened for modification	C:\Windows\CIO0P3D\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\DGQ2X5G.exe	smss.exe
File opened for modification	C:\Windows\CIO0P3D\system.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\INW6S6Q.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	system.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\CIO0P3D\service.exe	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\CIO0P3D\system.exe	smss.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\CIO0P3D\regedit.cmd	system.exe
File opened for modification	C:\Windows\moonlight.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\lsass.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D\XDX3E1U.com	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\INW6S6Q.exe	smss.exe
File opened for modification	C:\Windows\CIO0P3D\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\CIO0P3D\XDX3E1U.com	lsass.exe
File opened for modification	C:\Windows\CIO0P3D\XDX3E1U.com	smss.exe
File opened for modification	C:\Windows\INW6S6Q.exe	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D	system.exe
File opened for modification	C:\Windows\INW6S6Q.exe	winlogon.exe
File opened for modification	C:\Windows\CIO0P3D\smss.exe	system.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\CIO0P3D\smss.exe	smss.exe
File opened for modification	C:\Windows\CIO0P3D\service.exe	smss.exe
File opened for modification	C:\Windows\CIO0P3D\smss.exe	winlogon.exe
File opened for modification	C:\Windows\CIO0P3D\winlogon.exe	system.exe
File opened for modification	C:\Windows\CIO0P3D\LEK2S8C.exe	lsass.exe
File opened for modification	C:\Windows\CIO0P3D\service.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D\LEK2S8C.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D\XDX3E1U.com	system.exe
File opened for modification	C:\Windows\CIO0P3D	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CIO0P3D	smss.exe
File opened for modification	C:\Windows\CIO0P3D\system.exe	system.exe
File opened for modification	C:\Windows\CIO0P3D\smss.exe	lsass.exe
File opened for modification	C:\Windows\CIO0P3D\MYpIC.zip	system.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File created	C:\Windows\MooNlight.txt	smss.exe
File opened for modification	C:\Windows\CIO0P3D\system.exe	lsass.exe
File opened for modification	C:\Windows\DGQ2X5G.exe	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4016	1632	WerFault.exe	82
4216	1976	WerFault.exe	84
2456	1976	WerFault.exe	84
3272	1976	WerFault.exe	84

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
1632	service.exe
2556	smss.exe
2236	winlogon.exe
1976	system.exe
3856	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1632	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	82
PID 1556 wrote to memory of 1632	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	82
PID 1556 wrote to memory of 1632	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	82
PID 1556 wrote to memory of 2556	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	83
PID 1556 wrote to memory of 2556	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	83
PID 1556 wrote to memory of 2556	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	83
PID 1556 wrote to memory of 1976	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	84
PID 1556 wrote to memory of 1976	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	84
PID 1556 wrote to memory of 1976	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	84
PID 1556 wrote to memory of 2236	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	85
PID 1556 wrote to memory of 2236	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	85
PID 1556 wrote to memory of 2236	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	85
PID 1556 wrote to memory of 3856	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	89
PID 1556 wrote to memory of 3856	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	89
PID 1556 wrote to memory of 3856	1556	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	89

C:\Users\Admin\AppData\Local\Temp\1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\CIO0P3D\service.exe
  "C:\Windows\CIO0P3D\service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 676
    3⤵
    - Program crash
    PID:4016
- C:\Windows\CIO0P3D\smss.exe
  "C:\Windows\CIO0P3D\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2556
- C:\Windows\CIO0P3D\system.exe
  "C:\Windows\CIO0P3D\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1380
    3⤵
    - Program crash
    PID:4216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1384
    3⤵
    - Program crash
    PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1412
    3⤵
    - Program crash
    PID:3272
- C:\Windows\CIO0P3D\winlogon.exe
  "C:\Windows\CIO0P3D\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2236
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1632 -ip 1632
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1976 -ip 1976
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1976 -ip 1976
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1976 -ip 1976
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\CIO0P3D\LEK2S8C.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\CIO0P3D\LEK2S8C.exe

Filesize
585KB

MD5
1f6d1675439ec34847167bc32fb904c9

SHA1
560e255a5c367dea5fa00a607509b79cc77509a8

SHA256
c39a93d9d85ba93af9bddf831e377448048e2bfc7afd37b8ed6e7f81befafdd9

SHA512
d4dc5a48613de2f254b693c3357d2b529c2dde82d6d95f175e4433db7d73a8f4a08d4de454b054c2637809840e4096c4f9e0c8c62949313730a4381c9c6a4fbd

Download Submit
C:\Windows\CIO0P3D\LEK2S8C.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\CIO0P3D\LEK2S8C.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\CIO0P3D\XDX3E1U.com

Filesize
585KB

MD5
25f6a3d36a5de06f888021d03097ecf7

SHA1
8015822fbd017c83207d4e098a8b77a28e514cd3

SHA256
cfc24a01ef33d7b7373cf2a50ff29036f0ccc2251bb5e3fbe4c1bdf299e1a40e

SHA512
e34164124e5873fb0d049ffa9ae9f8ade2eb20e786d2fefc04da48c37686282ba800403ab4d04296bc037fe33895294d7d8283913047322cd5aea8187dda2ab4

Download Submit
C:\Windows\CIO0P3D\XDX3E1U.com

Filesize
585KB

MD5
25f6a3d36a5de06f888021d03097ecf7

SHA1
8015822fbd017c83207d4e098a8b77a28e514cd3

SHA256
cfc24a01ef33d7b7373cf2a50ff29036f0ccc2251bb5e3fbe4c1bdf299e1a40e

SHA512
e34164124e5873fb0d049ffa9ae9f8ade2eb20e786d2fefc04da48c37686282ba800403ab4d04296bc037fe33895294d7d8283913047322cd5aea8187dda2ab4

Download Submit
C:\Windows\CIO0P3D\XDX3E1U.com

Filesize
585KB

MD5
5ce52217197df47202ab871a1362c8a0

SHA1
e9e398fde0420b2594bf0aa2ec0d9f77d1b24245

SHA256
5f974794af6b0421defb25958cefb4003329ab7dd9c129d0fdc7a7c476da1fd9

SHA512
0a004617e6028d14fc25c2342b092d9e2882367f964f3062f114da21ea8bcb6b8ab23ae0818c14d412a88d2d0623f6c186166b97de40645d02e816e0eb3fd7d3

Download Submit
C:\Windows\CIO0P3D\XDX3E1U.com

Filesize
585KB

MD5
5ce52217197df47202ab871a1362c8a0

SHA1
e9e398fde0420b2594bf0aa2ec0d9f77d1b24245

SHA256
5f974794af6b0421defb25958cefb4003329ab7dd9c129d0fdc7a7c476da1fd9

SHA512
0a004617e6028d14fc25c2342b092d9e2882367f964f3062f114da21ea8bcb6b8ab23ae0818c14d412a88d2d0623f6c186166b97de40645d02e816e0eb3fd7d3

Download Submit
C:\Windows\CIO0P3D\regedit.cmd

Filesize
585KB

MD5
1843b7445a84689e45962d5a2f7239a0

SHA1
d2e62464eac5b43c701b1a48bf09a01b7c565dd1

SHA256
604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

SHA512
d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805

Download Submit
C:\Windows\CIO0P3D\regedit.cmd

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
C:\Windows\CIO0P3D\regedit.cmd

Filesize
585KB

MD5
db1a9ba46a8d0e0ae7206c4775fc854f

SHA1
79abefc4a062461c81f6f98f14793d4dec2ed900

SHA256
7bef696a90271773ccb7647c5eca1d2007d3db958c1b1b85d9305127cc2e9dc5

SHA512
b380339ff49a6ca30a6fb4f393287764c93bf16c78463cf3c6804abe3407b8efd22dfa97e387d69e6f0b9cfe94ba7883fd3ae2f3817326c2fa69a46856d0ed10

Download Submit
C:\Windows\CIO0P3D\regedit.cmd

Filesize
585KB

MD5
1843b7445a84689e45962d5a2f7239a0

SHA1
d2e62464eac5b43c701b1a48bf09a01b7c565dd1

SHA256
604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

SHA512
d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805

Download Submit
C:\Windows\CIO0P3D\service.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\CIO0P3D\service.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\CIO0P3D\smss.exe

Filesize
585KB

MD5
fe92a0ec5e42dd0d8f35c151f08bf666

SHA1
ba1d9ea9649a693c6881b8052715c06ebb638b8c

SHA256
ef48d56ce3798339bccb0cee895a5d0bce90df49514b03889457cfeba1e2eedc

SHA512
b8f8b41db7ad5019f7bba7e588ca9f6607b6cd386a4e2fe4f6d5920bab6bee8cc972c6393699b30afae630ef1693e77a9845c33b7e460b56e99b514669e8fa4a

Download Submit
C:\Windows\CIO0P3D\smss.exe

Filesize
585KB

MD5
fe92a0ec5e42dd0d8f35c151f08bf666

SHA1
ba1d9ea9649a693c6881b8052715c06ebb638b8c

SHA256
ef48d56ce3798339bccb0cee895a5d0bce90df49514b03889457cfeba1e2eedc

SHA512
b8f8b41db7ad5019f7bba7e588ca9f6607b6cd386a4e2fe4f6d5920bab6bee8cc972c6393699b30afae630ef1693e77a9845c33b7e460b56e99b514669e8fa4a

Download Submit
C:\Windows\CIO0P3D\smss.exe

Filesize
585KB

MD5
fe92a0ec5e42dd0d8f35c151f08bf666

SHA1
ba1d9ea9649a693c6881b8052715c06ebb638b8c

SHA256
ef48d56ce3798339bccb0cee895a5d0bce90df49514b03889457cfeba1e2eedc

SHA512
b8f8b41db7ad5019f7bba7e588ca9f6607b6cd386a4e2fe4f6d5920bab6bee8cc972c6393699b30afae630ef1693e77a9845c33b7e460b56e99b514669e8fa4a

Download Submit
C:\Windows\CIO0P3D\system.exe

Filesize
585KB

MD5
ca08ac07ad9a743520a3fedb5e167cd4

SHA1
33720ca68a06a303d0aca9f197c837d1a78b2893

SHA256
4679314fa23a9490f462323ba783228b0a7179fdc362cb7eb435dc67bafbf4f6

SHA512
848e8c5c042f61f2ff3ac812a00f9e65e8eaa5d6c68edd0eb366c0c32cee877044742a38f15280544398ae23ae7b67ca53a0ec63038e64c47a74b0c353348289

Download Submit
C:\Windows\CIO0P3D\system.exe

Filesize
585KB

MD5
ca08ac07ad9a743520a3fedb5e167cd4

SHA1
33720ca68a06a303d0aca9f197c837d1a78b2893

SHA256
4679314fa23a9490f462323ba783228b0a7179fdc362cb7eb435dc67bafbf4f6

SHA512
848e8c5c042f61f2ff3ac812a00f9e65e8eaa5d6c68edd0eb366c0c32cee877044742a38f15280544398ae23ae7b67ca53a0ec63038e64c47a74b0c353348289

Download Submit
C:\Windows\CIO0P3D\system.exe

Filesize
585KB

MD5
ca08ac07ad9a743520a3fedb5e167cd4

SHA1
33720ca68a06a303d0aca9f197c837d1a78b2893

SHA256
4679314fa23a9490f462323ba783228b0a7179fdc362cb7eb435dc67bafbf4f6

SHA512
848e8c5c042f61f2ff3ac812a00f9e65e8eaa5d6c68edd0eb366c0c32cee877044742a38f15280544398ae23ae7b67ca53a0ec63038e64c47a74b0c353348289

Download Submit
C:\Windows\CIO0P3D\winlogon.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\CIO0P3D\winlogon.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\CIO0P3D\winlogon.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\DGQ2X5G.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\DGQ2X5G.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\DGQ2X5G.exe

Filesize
585KB

MD5
957c1d38d58cdcd46c7db3e60cf4b322

SHA1
09f773e91acc88594fadc0137159412d01329288

SHA256
3f025a67d24604db9f356da84db0321a973d5f33d58aac8cc0a11a8610063d8f

SHA512
3ec07e6c17cb883cf64b2f03f9b962a4899fcee1574f7b4c5e858ee812f43e5224133681257c037b62bde0d9e77bfa98e1b62bcc49a073154fbb96723816ceff

Download Submit
C:\Windows\DGQ2X5G.exe

Filesize
585KB

MD5
957c1d38d58cdcd46c7db3e60cf4b322

SHA1
09f773e91acc88594fadc0137159412d01329288

SHA256
3f025a67d24604db9f356da84db0321a973d5f33d58aac8cc0a11a8610063d8f

SHA512
3ec07e6c17cb883cf64b2f03f9b962a4899fcee1574f7b4c5e858ee812f43e5224133681257c037b62bde0d9e77bfa98e1b62bcc49a073154fbb96723816ceff

Download Submit
C:\Windows\DGQ2X5G.exe

Filesize
585KB

MD5
957c1d38d58cdcd46c7db3e60cf4b322

SHA1
09f773e91acc88594fadc0137159412d01329288

SHA256
3f025a67d24604db9f356da84db0321a973d5f33d58aac8cc0a11a8610063d8f

SHA512
3ec07e6c17cb883cf64b2f03f9b962a4899fcee1574f7b4c5e858ee812f43e5224133681257c037b62bde0d9e77bfa98e1b62bcc49a073154fbb96723816ceff

Download Submit
C:\Windows\INW6S6Q.exe

Filesize
585KB

MD5
e39be03b1e007add00c5aea814006cdb

SHA1
a7e0f841e5066a0cb6b3f822c01a92cab034a2ca

SHA256
1f45b089eb4c876c6b644c47685eac59b85b96d8ff4fa22a1ae7a6aebdae1c72

SHA512
97081e698db5da9b966437dd401dd05e3f425bbd2b213e591fae740e73268ac00a00395e6c6dacd8172048fc5d35976874fcd2e9ca2d7464e613f4a17a8f9014

Download Submit
C:\Windows\INW6S6Q.exe

Filesize
585KB

MD5
e39be03b1e007add00c5aea814006cdb

SHA1
a7e0f841e5066a0cb6b3f822c01a92cab034a2ca

SHA256
1f45b089eb4c876c6b644c47685eac59b85b96d8ff4fa22a1ae7a6aebdae1c72

SHA512
97081e698db5da9b966437dd401dd05e3f425bbd2b213e591fae740e73268ac00a00395e6c6dacd8172048fc5d35976874fcd2e9ca2d7464e613f4a17a8f9014

Download Submit
C:\Windows\INW6S6Q.exe

Filesize
585KB

MD5
def5ce02af0dbde77a5b68b16f1515d1

SHA1
bf43840af8f62c6e43c69bb62ed8e3865a8c3980

SHA256
4a76d74118d7043d401cfab284f2989e50cfabd3889c1faf0e67d40a0b6ba025

SHA512
381fed88273dd20c33af02fb1dc32c8a50f8bb353a9942336d3dfd1eec811c5c2bac44df0ab896a1b02fd0b3ca643263dedac9fa480a0110dbffb1d04642b7c9

Download Submit
C:\Windows\INW6S6Q.exe

Filesize
585KB

MD5
def5ce02af0dbde77a5b68b16f1515d1

SHA1
bf43840af8f62c6e43c69bb62ed8e3865a8c3980

SHA256
4a76d74118d7043d401cfab284f2989e50cfabd3889c1faf0e67d40a0b6ba025

SHA512
381fed88273dd20c33af02fb1dc32c8a50f8bb353a9942336d3dfd1eec811c5c2bac44df0ab896a1b02fd0b3ca643263dedac9fa480a0110dbffb1d04642b7c9

Download Submit
C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd

Filesize
585KB

MD5
9cc7f8f26272b01191f6649c4d010ddf

SHA1
e5acf0ecc87a188249d98c1d20acea213df088a0

SHA256
8a51eb13c964df17d391364a596eb4c07192cb453429d13d3364cf821061459e

SHA512
b2e6d9d1bb6b669b1469894ec0fa0e9bf5dcede89ef2cf97baa3011a242600445bf9f5e54dc62635fd6e9266a54e70a4162cb8c54fc7b3bbb3efe35a52c47a83

Download Submit
C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd

Filesize
585KB

MD5
09a5fe8be34990b7ded9d52e188c558b

SHA1
c4d72ce0a15b85092756d84f7881886d238bfcd3

SHA256
cc585efab49ec023201a488a40b012568f58aecc69888dfd431bb0ef3783ba1a

SHA512
6c3b2ce1a6234d0ac742d4580a2383cd9c565c06a4ecfec8de2502cbbd6c4d57da6de4a3ad9c858c755e66c58340fb6fbd85399a43250f91d7e4e9100c8bcd49

Download Submit
C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd

Filesize
585KB

MD5
e7c3a92d8a96b2cb2695e80cc7e70477

SHA1
da33cde273581ee3847e6f608498b0f1ae95292c

SHA256
53f4e3a4d4333508995863c1ecec8f83cada47a8af934043555b03c5291da0f7

SHA512
31b81245a051719a29e5f21067a8c62eb0db6dac7c456c2fa8827ed22da8f5bd5669de1b6350da9db7a18c47c39417bcdbfdba021020c1cb01d028a35f1db026

Download Submit
C:\Windows\SysWOW64\ETV3Y4K\MHG8M4I.cmd

Filesize
585KB

MD5
66e23a78a09337f0c1a2ce2b0de89ff7

SHA1
09c591946472054c13498031fb78fc291a9c3047

SHA256
5d7bfae4887e068ea8af77e2d3938a70976a41b2478dae829ae2b50c3b344f5e

SHA512
eef0c81bc93ed25be0469d61679cd13c66f538c22efb22c1da1e602081600b50e01e0d4482c7fe87c8fdfc347aab8c45beadde14a869e70395d044c708ac2635

Download Submit
C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe

Filesize
585KB

MD5
957c1d38d58cdcd46c7db3e60cf4b322

SHA1
09f773e91acc88594fadc0137159412d01329288

SHA256
3f025a67d24604db9f356da84db0321a973d5f33d58aac8cc0a11a8610063d8f

SHA512
3ec07e6c17cb883cf64b2f03f9b962a4899fcee1574f7b4c5e858ee812f43e5224133681257c037b62bde0d9e77bfa98e1b62bcc49a073154fbb96723816ceff

Download Submit
C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe

Filesize
585KB

MD5
957c1d38d58cdcd46c7db3e60cf4b322

SHA1
09f773e91acc88594fadc0137159412d01329288

SHA256
3f025a67d24604db9f356da84db0321a973d5f33d58aac8cc0a11a8610063d8f

SHA512
3ec07e6c17cb883cf64b2f03f9b962a4899fcee1574f7b4c5e858ee812f43e5224133681257c037b62bde0d9e77bfa98e1b62bcc49a073154fbb96723816ceff

Download Submit
C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe

Filesize
585KB

MD5
2fc98744385a39c832b89f8e7db30845

SHA1
9cf6722e092e7d9b8a8b41d85e0e2db39e8bea4c

SHA256
7d5a55640385cf4a16e2e59dc9541dcf179bc4f5f7dd8a1216aea25e3dedcc7f

SHA512
3febbae8dc3e25907dc583d1221985c470ac58714295b0ee856620106922c144b77136d2e2702686e63caeed8bd8e84f4a8af7fb12102425e6c0779e639d5629

Download Submit
C:\Windows\SysWOW64\MHG8M4IINW6S6Q.exe

Filesize
585KB

MD5
2fc98744385a39c832b89f8e7db30845

SHA1
9cf6722e092e7d9b8a8b41d85e0e2db39e8bea4c

SHA256
7d5a55640385cf4a16e2e59dc9541dcf179bc4f5f7dd8a1216aea25e3dedcc7f

SHA512
3febbae8dc3e25907dc583d1221985c470ac58714295b0ee856620106922c144b77136d2e2702686e63caeed8bd8e84f4a8af7fb12102425e6c0779e639d5629

Download Submit
C:\Windows\SysWOW64\SRV3D1N.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\SRV3D1N.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\SRV3D1N.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\SRV3D1N.exe

Filesize
585KB

MD5
fe92a0ec5e42dd0d8f35c151f08bf666

SHA1
ba1d9ea9649a693c6881b8052715c06ebb638b8c

SHA256
ef48d56ce3798339bccb0cee895a5d0bce90df49514b03889457cfeba1e2eedc

SHA512
b8f8b41db7ad5019f7bba7e588ca9f6607b6cd386a4e2fe4f6d5920bab6bee8cc972c6393699b30afae630ef1693e77a9845c33b7e460b56e99b514669e8fa4a

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
877d1b6cff32cde567cae0ee14152390

SHA1
b1c08e03299010c206acb59edcb81b0d2f0e3a24

SHA256
c692f9b3c3f5c66527bddc572ea533ad517dda88543dab9436e4204f7797363a

SHA512
a0da9c9d9d2117aed5ad59be98c037f3265daa889e86e24376759869f57a49043b92c5f2e9cc5ba1abf406bcda239fd049090e7ad90222271efb56d71371ec29

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b5932359a66451bb0b5c731cbe18409d

SHA1
894e21370074eef1296fdef572620a07209e6aa8

SHA256
77b3e95abb65c7c6da77a65edf7a15c32e19536440fc78cc2e769af5969789b7

SHA512
97700d0798343765184d9c191b056234189a91c28f85f54886b973e7073a812f5f5c2fa1a8fccb4b240371b2396287fbf2c8a3c2e1f06cb7bb03c8fc12c4199c

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b5932359a66451bb0b5c731cbe18409d

SHA1
894e21370074eef1296fdef572620a07209e6aa8

SHA256
77b3e95abb65c7c6da77a65edf7a15c32e19536440fc78cc2e769af5969789b7

SHA512
97700d0798343765184d9c191b056234189a91c28f85f54886b973e7073a812f5f5c2fa1a8fccb4b240371b2396287fbf2c8a3c2e1f06cb7bb03c8fc12c4199c

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b5932359a66451bb0b5c731cbe18409d

SHA1
894e21370074eef1296fdef572620a07209e6aa8

SHA256
77b3e95abb65c7c6da77a65edf7a15c32e19536440fc78cc2e769af5969789b7

SHA512
97700d0798343765184d9c191b056234189a91c28f85f54886b973e7073a812f5f5c2fa1a8fccb4b240371b2396287fbf2c8a3c2e1f06cb7bb03c8fc12c4199c

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b5932359a66451bb0b5c731cbe18409d

SHA1
894e21370074eef1296fdef572620a07209e6aa8

SHA256
77b3e95abb65c7c6da77a65edf7a15c32e19536440fc78cc2e769af5969789b7

SHA512
97700d0798343765184d9c191b056234189a91c28f85f54886b973e7073a812f5f5c2fa1a8fccb4b240371b2396287fbf2c8a3c2e1f06cb7bb03c8fc12c4199c

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
ec5702730c23e0a018294594ab43b089

SHA1
01fb205e1c0945f20727daf32e5d96a8143dff22

SHA256
6e7a81af9546674515074881e6075070f07f38340d7847b1c45d84a1e7137acd

SHA512
617224e82df6c6b88364194b787436d1cf27d918ad951bd58034955d07e1ed7842bc423ac900a96703f7845cf0c8303c3ef9ece2973851999ddd9f90ce4cb340

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
e311ef4df4009a9926e9d774568ad810

SHA1
8b546b1b626a28a4b117359065e43d5217cb9cfe

SHA256
dba59c4d0417da694c70255a4741b94c92bd6206b932870b4d1b8eefe7fbd9b8

SHA512
597399a7c5cb4b34de5ce070ccd2c2684bb601dded6456eb0bbd7a0cd13d0d4cefbbdc3a9a445840f033a49ec2554c46764535e115897623476ab6be64a89452

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
26f2877dc2b09e2739d77e92503c4ea4

SHA1
d5bf6af509884d16e6a11a5a3a3f57aa2de16d3c

SHA256
423cd8275afe8a3fec35335df91322e6640822ff7e25445451cb924c334479e8

SHA512
095f89ae79a3c5012c117c9ab07c1932b86ebf171efdb9ad7dd0709d3a8d48b6b9b2e74a1b1a0ccf96ac9ef415965b473dab2864cf3192149986342549511722

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
a6679ff6d0b14ec2b1ef181feb1d9fef

SHA1
c5459a8aa055e4cbb9518d1ef5d411d48ef8de8f

SHA256
5f93083e889ae9ca1f498cdebe90ddef52315edf22fc201fe7d9eba4e1e2e9b9

SHA512
322229369f1b73c5c1be2bd54d574c84519625559ee4d7f355786f51c82f8b0d5101571807af54c755f6e3e8bceeda33a8e06490b2a805cd19d91e9e5b7d7563

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
d738f36032f366e97e0a598f5d7e29c3

SHA1
56e6cd474d634e71390b036b80d69d91ad8908d4

SHA256
c45b2257d2b274708ff2c60d6b2fd3c3af0915b030e041c17a52c0f0c10d5d1c

SHA512
0f43e3139087a94a23d554b749fac83e814e1ee01bf0f23fab4d465fada078a29e255d01be808c1d7475925e43f3550ada8d153c7aff346cb5bd5d54c6b97b79

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
8d205ffd6d88ed41b19caa91a7aa994c

SHA1
5ee0cc6ef7ab500ffb99e42323fe5074b52cce91

SHA256
7500ef088d9a7f141d896bdcc21fc38675dc4763a301d657107ca9622f74ca99

SHA512
8462003ca9aead0737789bdd8a769608e6217e80c82264b439a1d649bc185880220959f9c4b2578cd0467fbca9409bfaeedaf1ab13e70e3a545eb11b239bb68f

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
8d205ffd6d88ed41b19caa91a7aa994c

SHA1
5ee0cc6ef7ab500ffb99e42323fe5074b52cce91

SHA256
7500ef088d9a7f141d896bdcc21fc38675dc4763a301d657107ca9622f74ca99

SHA512
8462003ca9aead0737789bdd8a769608e6217e80c82264b439a1d649bc185880220959f9c4b2578cd0467fbca9409bfaeedaf1ab13e70e3a545eb11b239bb68f

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
d738f36032f366e97e0a598f5d7e29c3

SHA1
56e6cd474d634e71390b036b80d69d91ad8908d4

SHA256
c45b2257d2b274708ff2c60d6b2fd3c3af0915b030e041c17a52c0f0c10d5d1c

SHA512
0f43e3139087a94a23d554b749fac83e814e1ee01bf0f23fab4d465fada078a29e255d01be808c1d7475925e43f3550ada8d153c7aff346cb5bd5d54c6b97b79

Download Submit
memory/1556-290-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1556-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1632-63-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1632-291-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1976-293-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1976-88-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1976-296-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2236-94-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2236-295-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2556-75-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2556-292-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3856-228-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3856-297-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads