40cace035de42ecc65ae3c0d36a9d07a3275a3c954583d1edca0b38ba4dac38a

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9180b853219865c1bfd90b3b75204e00.exe
Size

320KB
MD5

9180b853219865c1bfd90b3b75204e00
SHA1

983137213d2ab16cf437355905c12cf809eccc9f
SHA256

40cace035de42ecc65ae3c0d36a9d07a3275a3c954583d1edca0b38ba4dac38a
SHA512

fe4369b8c580269c9d8c6f9d080e569a3b73dc334a49457f0cda308343be35f36306cd45fa52fc22522bdcbc205d19d96212899e977e3bbf19de04b74cd91f87
SSDEEP

3072:m1lYxWpd54BaHI9Scb7qA0UXEfhEYbzPCTVZR3AWijGnvrwZ7M4W5NjapLNnkISf:WeHwXUU5EYCTvaBj2GML5NjcxFSf

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SYH6I0T\\EUD8N6T.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SYH6I0T\\EUD8N6T.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\SYH6I0T\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\SYH6I0T\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe

Executes dropped EXE 4 IoCs

pid	Process
2856	service.exe
2624	smss.exe
2556	system.exe
2040	lsass.exe

Loads dropped DLL 9 IoCs

pid	Process
1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe
1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe
1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe
1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe
1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0030000000016ff7-72.dat	upx
behavioral1/files/0x0030000000016ff7-113.dat	upx
behavioral1/files/0x0030000000016ff7-154.dat	upx
behavioral1/files/0x0030000000016ff7-189.dat	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0N6TIR = "C:\\Windows\\VXK0S2X.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\sYH0S2X0 = "C:\\Windows\\system32\\GYX5H1CDIR4M4L.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0N6TIR = "C:\\Windows\\VXK0S2X.exe"	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\sYH0S2X0 = "C:\\Windows\\system32\\GYX5H1CDIR4M4L.exe"	lsass.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\U:	service.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\NMP1U8I.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F\GYX5H1C.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SysWOW64\NMP1U8I.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\NMP1U8I.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SysWOW64\NMP1U8I.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F\GYX5H1C.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F\GYX5H1C.cmd	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F\GYX5H1C.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\WOP1S2F	NEAS.9180b853219865c1bfd90b3b75204e00.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYH6I0T\service.exe	system.exe
File opened for modification	C:\Windows\SYH6I0T\winlogon.exe	system.exe
File opened for modification	C:\Windows\lsass.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\SYH6I0T\service.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\VXK0S2X.exe	service.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	system.exe
File opened for modification	C:\Windows\SYH6I0T\RVR0V7O.com	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\smss.exe	service.exe
File opened for modification	C:\Windows\VXK0S2X.exe	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SYH6I0T\smss.exe	system.exe
File opened for modification	C:\Windows\SYH6I0T\MYpIC.zip	system.exe
File opened for modification	C:\Windows\VXK0S2X.exe	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\SYH6I0T\regedit.cmd	service.exe
File opened for modification	C:\Windows\DIR4M4L.exe	system.exe
File opened for modification	C:\Windows\SYH6I0T	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\EUD8N6T.exe	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\regedit.cmd	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SYH6I0T\winlogon.exe	service.exe
File opened for modification	C:\Windows\SYH6I0T	system.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\smss.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\system.exe	system.exe
File opened for modification	C:\Windows\SYH6I0T\EUD8N6T.exe	system.exe
File opened for modification	C:\Windows\DIR4M4L.exe	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\RVR0V7O.com	lsass.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\cypreg.dll	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\system.exe	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\smss.exe	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\RVR0V7O.com	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T	service.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\SYH6I0T\service.exe	lsass.exe
File opened for modification	C:\Windows\DIR4M4L.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\system.exe	lsass.exe
File opened for modification	C:\Windows\VXK0S2X.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\SYH6I0T\EUD8N6T.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\SYH6I0T\RVR0V7O.com	service.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\SYH6I0T	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\system.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\SYH6I0T\EUD8N6T.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\DIR4M4L.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\service.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\winlogon.exe	NEAS.9180b853219865c1bfd90b3b75204e00.exe
File opened for modification	C:\Windows\SYH6I0T\regedit.cmd	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	2624	WerFault.exe	29

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe
2856	service.exe
2624	smss.exe
2556	system.exe
2040	lsass.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2856	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	28
PID 1044 wrote to memory of 2856	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	28
PID 1044 wrote to memory of 2856	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	28
PID 1044 wrote to memory of 2856	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	28
PID 1044 wrote to memory of 2624	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	29
PID 1044 wrote to memory of 2624	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	29
PID 1044 wrote to memory of 2624	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	29
PID 1044 wrote to memory of 2624	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	29
PID 1044 wrote to memory of 2556	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	30
PID 1044 wrote to memory of 2556	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	30
PID 1044 wrote to memory of 2556	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	30
PID 1044 wrote to memory of 2556	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	30
PID 2624 wrote to memory of 2848	2624	smss.exe	31
PID 2624 wrote to memory of 2848	2624	smss.exe	31
PID 2624 wrote to memory of 2848	2624	smss.exe	31
PID 2624 wrote to memory of 2848	2624	smss.exe	31
PID 1044 wrote to memory of 2040	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	32
PID 1044 wrote to memory of 2040	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	32
PID 1044 wrote to memory of 2040	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	32
PID 1044 wrote to memory of 2040	1044	NEAS.9180b853219865c1bfd90b3b75204e00.exe	32

C:\Users\Admin\AppData\Local\Temp\NEAS.9180b853219865c1bfd90b3b75204e00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9180b853219865c1bfd90b3b75204e00.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SYH6I0T\service.exe
  "C:\Windows\SYH6I0T\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2856
- C:\Windows\SYH6I0T\smss.exe
  "C:\Windows\SYH6I0T\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 400
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2848
- C:\Windows\SYH6I0T\system.exe
  "C:\Windows\SYH6I0T\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2556
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\DIR4M4L.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
C:\Windows\DIR4M4L.exe

Filesize
320KB

MD5
9c572a5fc0a267335bf379591d13d469

SHA1
873ccc16a7f258f35e63953661d94fe89e839c3e

SHA256
31a6298eb208994e9c33fcd49be516ef96f5df5aa600f8e8abc0cbdbebf09f1d

SHA512
eaec5d6c6c949201ae371a1218dfd7e37a2b0ce0e40edc2a5e070312b287ccb36644c6f398673be805eb77dbf75064a37a43c59408140f1c4e21c60e32c8266d

Download Submit
C:\Windows\DIR4M4L.exe

Filesize
320KB

MD5
472c26d5a18d709e5292872c078d12e8

SHA1
877fc60f0a77ea66392f3a4bc1f1c8847430400b

SHA256
6050ec43b93a28348aae0d8f0306b13083eadc5a8226e5e2faaee3e24fe5954c

SHA512
4dd1be455b026b89db8c6f0f21c90938f09fc6fcde5b2b1f41492188e449109b0c1169ebe8471695f8eb6a0cc69a6182801a05fca1e197aab1f6f0fadffe99a1

Download Submit
C:\Windows\SYH6I0T\EUD8N6T.exe

Filesize
320KB

MD5
7f80f30115775f24c4055c31e0e8667d

SHA1
45f804930eb30e8a5c8bc1a5921f0859aaad73db

SHA256
05700d5fc0347eeb2d9fdad25b32ea82d37ec8ec584f359dfdb0123ab250c415

SHA512
633cf1c08cf70e22916ea3a818e8d6539fc2f29f19bf58849dcb14edf1822a61338018f0f5d65449a72278e79fad5551323683df4d919384bdfb0a9fa7845a42

Download Submit
C:\Windows\SYH6I0T\EUD8N6T.exe

Filesize
320KB

MD5
e4d44da2c78ffafcc2f64d059192819b

SHA1
765245652905451c10439aea74c80921730e8333

SHA256
273ff176eec561dd797fe00a5ee4ad98d8b8084ca9ed56a7bacc0dca42b0536e

SHA512
4397425ea63bdda80f418fd3173bf5fb61e822fd787ac70271a4e7d6e85adf0efa86abecb3bde0416cc590ec91d9a9fa1ff0fcf13582ac2160cc073293bc4e46

Download Submit
C:\Windows\SYH6I0T\RVR0V7O.com

Filesize
320KB

MD5
ac142294c3b682d32ec03084369d4e5f

SHA1
f08a6fb25032ecaa61b523cd77898e1fbc095c34

SHA256
eefe0bd44c481a827926767eac0c0fca013537687cb55531aedafad55226a826

SHA512
3892817be8020891a188c2ccd0daae4fe0457048e1824c7039d09e9c0081903f131cc2f728ccd0e317cb271bc7913434866a0fffb9bd65c9e2a63f297c7eb5dd

Download Submit
C:\Windows\SYH6I0T\RVR0V7O.com

Filesize
320KB

MD5
d50086bcd569d3cc44c7933eaccb7d83

SHA1
1b0a3637247839df1a621bcd10a8cd227d17f74c

SHA256
158e8e25d11f5793feb4b9f98da0c95d93601b074eb91c038de8d69dbd64858d

SHA512
e6d467afa7a91caca250a1eb6cba8d6c95f4f46688732dbdfd9d173042f42c09ec56f8b447d15b014b046a40e300a566d57c0d6f31b00ca6730ce8ec1dc6a8fd

Download Submit
C:\Windows\SYH6I0T\RVR0V7O.com

Filesize
320KB

MD5
d09f0ddf0155fba0d96e66003f9f21ce

SHA1
2ac0e6937c2bc1b09f1cf2f446ab709c3cf5b7f1

SHA256
6c33e9e0b343047ff42bdb93f2e50b034c12ef443f48df8f91e7c3e7ef09b532

SHA512
b7a9553e60a842a6451c251587257a7ca94910fdfac7b819c28f4f1e8fc2fac96c43eb6487b17f03cbcd56ec28466b0ac22ba4f360a76d90cc8a1516e695728f

Download Submit
C:\Windows\SYH6I0T\regedit.cmd

Filesize
320KB

MD5
9c572a5fc0a267335bf379591d13d469

SHA1
873ccc16a7f258f35e63953661d94fe89e839c3e

SHA256
31a6298eb208994e9c33fcd49be516ef96f5df5aa600f8e8abc0cbdbebf09f1d

SHA512
eaec5d6c6c949201ae371a1218dfd7e37a2b0ce0e40edc2a5e070312b287ccb36644c6f398673be805eb77dbf75064a37a43c59408140f1c4e21c60e32c8266d

Download Submit
C:\Windows\SYH6I0T\regedit.cmd

Filesize
320KB

MD5
844ee291fa418c7f8be836cdf4355bc4

SHA1
3c57ac1d1b7079225de82be7cb58a7f0cf0d12bf

SHA256
8fc5856412ceddde64759113f40659c89a4d28d096e6ddbe0ea4c9bfae15fb50

SHA512
5dcb0825ad086d228bde773e5954395916167fa9f46e8ef2c5a18fcaeaa7509e590f1752ca15b390490ae0e4aa6020cce20371fdfde9b33586878f402c2bc39a

Download Submit
C:\Windows\SYH6I0T\service.exe

Filesize
320KB

MD5
86fc61a08d4589ce206cedb15be0f0c5

SHA1
99665daca8b77d14e62c6352f0cc3db4acd4414f

SHA256
f1868a11c8918d673b32bbf16bee910211e79006f0727acdc0b5bbb1eb7b52aa

SHA512
695b8990c1d2e7d92a9d1b577ed91236e664b1ef52f745a797805093b932ecaadc9e0601213de8df6fb0f8053723110246d800b07cbe74e9ce2a1373be13377a

Download Submit
C:\Windows\SYH6I0T\service.exe

Filesize
320KB

MD5
86fc61a08d4589ce206cedb15be0f0c5

SHA1
99665daca8b77d14e62c6352f0cc3db4acd4414f

SHA256
f1868a11c8918d673b32bbf16bee910211e79006f0727acdc0b5bbb1eb7b52aa

SHA512
695b8990c1d2e7d92a9d1b577ed91236e664b1ef52f745a797805093b932ecaadc9e0601213de8df6fb0f8053723110246d800b07cbe74e9ce2a1373be13377a

Download Submit
C:\Windows\SYH6I0T\service.exe

Filesize
320KB

MD5
86fc61a08d4589ce206cedb15be0f0c5

SHA1
99665daca8b77d14e62c6352f0cc3db4acd4414f

SHA256
f1868a11c8918d673b32bbf16bee910211e79006f0727acdc0b5bbb1eb7b52aa

SHA512
695b8990c1d2e7d92a9d1b577ed91236e664b1ef52f745a797805093b932ecaadc9e0601213de8df6fb0f8053723110246d800b07cbe74e9ce2a1373be13377a

Download Submit
C:\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
C:\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
C:\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
C:\Windows\SYH6I0T\system.exe

Filesize
320KB

MD5
7f80f30115775f24c4055c31e0e8667d

SHA1
45f804930eb30e8a5c8bc1a5921f0859aaad73db

SHA256
05700d5fc0347eeb2d9fdad25b32ea82d37ec8ec584f359dfdb0123ab250c415

SHA512
633cf1c08cf70e22916ea3a818e8d6539fc2f29f19bf58849dcb14edf1822a61338018f0f5d65449a72278e79fad5551323683df4d919384bdfb0a9fa7845a42

Download Submit
C:\Windows\SYH6I0T\system.exe

Filesize
320KB

MD5
7f80f30115775f24c4055c31e0e8667d

SHA1
45f804930eb30e8a5c8bc1a5921f0859aaad73db

SHA256
05700d5fc0347eeb2d9fdad25b32ea82d37ec8ec584f359dfdb0123ab250c415

SHA512
633cf1c08cf70e22916ea3a818e8d6539fc2f29f19bf58849dcb14edf1822a61338018f0f5d65449a72278e79fad5551323683df4d919384bdfb0a9fa7845a42

Download Submit
C:\Windows\SYH6I0T\winlogon.exe

Filesize
320KB

MD5
fecde990ee085332f2ff2a21a62b0b31

SHA1
b8a1b715ac37914a640b29e095e3718c43a5432c

SHA256
513cbf3d6fdbc39fbd2f8640e8baf76f819e1b2943555d794bfeb3b1259ee5d1

SHA512
78d9d43b6be7470325c38d79f0093c46b908805492c1847e6182c746f2f41de22a3396bb08c54bc0a7506e4322c4f6e08bb909f23db9c9bb6974422e9378e53d

Download Submit
C:\Windows\SYH6I0T\winlogon.exe

Filesize
320KB

MD5
d50086bcd569d3cc44c7933eaccb7d83

SHA1
1b0a3637247839df1a621bcd10a8cd227d17f74c

SHA256
158e8e25d11f5793feb4b9f98da0c95d93601b074eb91c038de8d69dbd64858d

SHA512
e6d467afa7a91caca250a1eb6cba8d6c95f4f46688732dbdfd9d173042f42c09ec56f8b447d15b014b046a40e300a566d57c0d6f31b00ca6730ce8ec1dc6a8fd

Download Submit
C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe

Filesize
320KB

MD5
ff5d7b8a098334308d03fa3fba9111be

SHA1
336d351d970f9dea897c92a27d618eb9467cfdaa

SHA256
e7dd8f416bda879696e386cc427883112fedf3791bbd98359d6a077bd68ac025

SHA512
a7bab06fdc83aaeccd480e2a362d1fe04f22bbade47b8b9f51803aa23af917c81fc3f611c8f1126fb7399d5957ada33c05f5fb627c3769e92d2bfd85f9dee35f

Download Submit
C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe

Filesize
320KB

MD5
ff5d7b8a098334308d03fa3fba9111be

SHA1
336d351d970f9dea897c92a27d618eb9467cfdaa

SHA256
e7dd8f416bda879696e386cc427883112fedf3791bbd98359d6a077bd68ac025

SHA512
a7bab06fdc83aaeccd480e2a362d1fe04f22bbade47b8b9f51803aa23af917c81fc3f611c8f1126fb7399d5957ada33c05f5fb627c3769e92d2bfd85f9dee35f

Download Submit
C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
C:\Windows\SysWOW64\GYX5H1CDIR4M4L.exe

Filesize
320KB

MD5
07d2600b029dbb37041cf7f19de2bf00

SHA1
6a8b694e183a3c03d1103fefda8bdb4f586e0ed8

SHA256
8753a867cdc9d9b9d42e957a1554ea573984bf0060c1bb3c01bf8b695b73e54c

SHA512
6d35077b2a64fd96fdd06b834ea166dba44193a9e64fd715c93d70027d1994c7e1bf0bf1ce2c06cc7150f144964c703f1d4417988af52f65512e091159e49502

Download Submit
C:\Windows\SysWOW64\NMP1U8I.exe

Filesize
320KB

MD5
bd5a0290d4d3cd371842e4cdb855d179

SHA1
7b3059a25fa77306837517d8d24ed04fa10cc3e6

SHA256
b1108c513abe0f49a17e5955e29dec349f69d8ce98a663100d46630d438fce60

SHA512
9c1a9f5f43e302e5a0dfd0551841d9c8ef8341413363c94c437c11fbf40edbfc111de2c5750914d7922614267a5720e82379c244cd34966ef91d13cda7274686

Download Submit
C:\Windows\SysWOW64\NMP1U8I.exe

Filesize
320KB

MD5
668b8b34236671554f3771120a8cd948

SHA1
993dbf9f58de95b3aef28e682092aaaec25a9c7a

SHA256
57d09e360774a1c763e9b48d4fe46b4c3e7ee198fb4cdaf7ce1229d01779812a

SHA512
0ad708ed14a43e0266fefaa479d831c5c6ed22b50669cf3de6bbd17ca5b09cf30a92a859723bc2aee1655704cdb954ec5a44efa3a341b3807426c7491d01602e

Download Submit
C:\Windows\SysWOW64\NMP1U8I.exe

Filesize
320KB

MD5
ff5d7b8a098334308d03fa3fba9111be

SHA1
336d351d970f9dea897c92a27d618eb9467cfdaa

SHA256
e7dd8f416bda879696e386cc427883112fedf3791bbd98359d6a077bd68ac025

SHA512
a7bab06fdc83aaeccd480e2a362d1fe04f22bbade47b8b9f51803aa23af917c81fc3f611c8f1126fb7399d5957ada33c05f5fb627c3769e92d2bfd85f9dee35f

Download Submit
C:\Windows\SysWOW64\WOP1S2F\GYX5H1C.cmd

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
C:\Windows\SysWOW64\WOP1S2F\GYX5H1C.cmd

Filesize
320KB

MD5
9486ed24cafa035ca16faf1631449f87

SHA1
093a079ffd332b441fba8da59ab00890c793265b

SHA256
3a06933a36d0193c704aebd86aaec06fd7a5aaea3f97ee82bc88ee38dea0737a

SHA512
0705ab2a9eb1f22a894230c88d2a50414b254750be197e9a9879feeee7d9579e64e3a1f4c1c8fe5f965c1d86e5f8c0d8a5b8e6d1c3a6aca900b1d3ae43d4d7d4

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b54ebb9fae2016d69b2739abeb0cb51c

SHA1
34f932f1068d3e37560279f99b7ce678d1bde97b

SHA256
0587ccf39833ab3bf6c830686ed05ce878af61c9270078fd3a64c445521163c4

SHA512
1af62cfc9f9cee0fd013c480697792731949153d14582b27181e689c4b1a7507fa83c3837b6f75e04e8eefccd5f8eec2907d742d35f481bda5a03a89b0b6fab8

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b54ebb9fae2016d69b2739abeb0cb51c

SHA1
34f932f1068d3e37560279f99b7ce678d1bde97b

SHA256
0587ccf39833ab3bf6c830686ed05ce878af61c9270078fd3a64c445521163c4

SHA512
1af62cfc9f9cee0fd013c480697792731949153d14582b27181e689c4b1a7507fa83c3837b6f75e04e8eefccd5f8eec2907d742d35f481bda5a03a89b0b6fab8

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b54ebb9fae2016d69b2739abeb0cb51c

SHA1
34f932f1068d3e37560279f99b7ce678d1bde97b

SHA256
0587ccf39833ab3bf6c830686ed05ce878af61c9270078fd3a64c445521163c4

SHA512
1af62cfc9f9cee0fd013c480697792731949153d14582b27181e689c4b1a7507fa83c3837b6f75e04e8eefccd5f8eec2907d742d35f481bda5a03a89b0b6fab8

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b54ebb9fae2016d69b2739abeb0cb51c

SHA1
34f932f1068d3e37560279f99b7ce678d1bde97b

SHA256
0587ccf39833ab3bf6c830686ed05ce878af61c9270078fd3a64c445521163c4

SHA512
1af62cfc9f9cee0fd013c480697792731949153d14582b27181e689c4b1a7507fa83c3837b6f75e04e8eefccd5f8eec2907d742d35f481bda5a03a89b0b6fab8

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
b54ebb9fae2016d69b2739abeb0cb51c

SHA1
34f932f1068d3e37560279f99b7ce678d1bde97b

SHA256
0587ccf39833ab3bf6c830686ed05ce878af61c9270078fd3a64c445521163c4

SHA512
1af62cfc9f9cee0fd013c480697792731949153d14582b27181e689c4b1a7507fa83c3837b6f75e04e8eefccd5f8eec2907d742d35f481bda5a03a89b0b6fab8

Download Submit
C:\Windows\VXK0S2X.exe

Filesize
320KB

MD5
d50086bcd569d3cc44c7933eaccb7d83

SHA1
1b0a3637247839df1a621bcd10a8cd227d17f74c

SHA256
158e8e25d11f5793feb4b9f98da0c95d93601b074eb91c038de8d69dbd64858d

SHA512
e6d467afa7a91caca250a1eb6cba8d6c95f4f46688732dbdfd9d173042f42c09ec56f8b447d15b014b046a40e300a566d57c0d6f31b00ca6730ce8ec1dc6a8fd

Download Submit
C:\Windows\VXK0S2X.exe

Filesize
320KB

MD5
d50086bcd569d3cc44c7933eaccb7d83

SHA1
1b0a3637247839df1a621bcd10a8cd227d17f74c

SHA256
158e8e25d11f5793feb4b9f98da0c95d93601b074eb91c038de8d69dbd64858d

SHA512
e6d467afa7a91caca250a1eb6cba8d6c95f4f46688732dbdfd9d173042f42c09ec56f8b447d15b014b046a40e300a566d57c0d6f31b00ca6730ce8ec1dc6a8fd

Download Submit
C:\Windows\VXK0S2X.exe

Filesize
320KB

MD5
86fc61a08d4589ce206cedb15be0f0c5

SHA1
99665daca8b77d14e62c6352f0cc3db4acd4414f

SHA256
f1868a11c8918d673b32bbf16bee910211e79006f0727acdc0b5bbb1eb7b52aa

SHA512
695b8990c1d2e7d92a9d1b577ed91236e664b1ef52f745a797805093b932ecaadc9e0601213de8df6fb0f8053723110246d800b07cbe74e9ce2a1373be13377a

Download Submit
C:\Windows\VXK0S2X.exe

Filesize
320KB

MD5
dd32654a2bd2efadf95aca6994cf9b99

SHA1
63bd800de1028d648f6fc8ec08e5c4cfe3eec728

SHA256
87484dceb871e6b1faaf19e5d71fdcfedfae784dbdd578ed7f140945807646a0

SHA512
e98886b6050cbd94c327fbe508e360e96182d2ec25f791efdb9d814859d20d42e458c05d59dcc7056d0c534c477b0be05b9c70555a46857d3a230d432594e634

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
fc8abcba7beed80838a5e4648d805948

SHA1
889e8bcc6800b6966b849fff57df1e1b4e286871

SHA256
50243a2ff505fcb43f6d3047ea6a434e7b567bbfc84d0b7be6b677864353ea34

SHA512
cbc20dace4ac89f08e47bf24454b8741c423253bcadf10fcbc8a62fbe3bbdf810a97c2201f8f138ad5d6ec54e52ced897e8e9fcb1fa67eda485e136f0d262f62

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
3e4aa52683adf2ae9b4ab3f64a02d1a2

SHA1
b7e309eb33f95a409401effd72f919c720030edb

SHA256
15c9ad0863df8f1db620e11044020a237fc27af295404ae62bc4bbd2608c5538

SHA512
2fb67a139fe992317e77c0acc291da363481a949f359b8472ceb0131c20a17d17d14d25682ab9b215290734532e564d72d75e8c1cc88d43dcd3fbba618732385

Download Submit
C:\Windows\lsass.exe

Filesize
320KB

MD5
fecde990ee085332f2ff2a21a62b0b31

SHA1
b8a1b715ac37914a640b29e095e3718c43a5432c

SHA256
513cbf3d6fdbc39fbd2f8640e8baf76f819e1b2943555d794bfeb3b1259ee5d1

SHA512
78d9d43b6be7470325c38d79f0093c46b908805492c1847e6182c746f2f41de22a3396bb08c54bc0a7506e4322c4f6e08bb909f23db9c9bb6974422e9378e53d

Download Submit
C:\Windows\lsass.exe

Filesize
320KB

MD5
fecde990ee085332f2ff2a21a62b0b31

SHA1
b8a1b715ac37914a640b29e095e3718c43a5432c

SHA256
513cbf3d6fdbc39fbd2f8640e8baf76f819e1b2943555d794bfeb3b1259ee5d1

SHA512
78d9d43b6be7470325c38d79f0093c46b908805492c1847e6182c746f2f41de22a3396bb08c54bc0a7506e4322c4f6e08bb909f23db9c9bb6974422e9378e53d

Download Submit
C:\Windows\lsass.exe

Filesize
320KB

MD5
fecde990ee085332f2ff2a21a62b0b31

SHA1
b8a1b715ac37914a640b29e095e3718c43a5432c

SHA256
513cbf3d6fdbc39fbd2f8640e8baf76f819e1b2943555d794bfeb3b1259ee5d1

SHA512
78d9d43b6be7470325c38d79f0093c46b908805492c1847e6182c746f2f41de22a3396bb08c54bc0a7506e4322c4f6e08bb909f23db9c9bb6974422e9378e53d

Download Submit
C:\Windows\lsass.exe

Filesize
320KB

MD5
d50086bcd569d3cc44c7933eaccb7d83

SHA1
1b0a3637247839df1a621bcd10a8cd227d17f74c

SHA256
158e8e25d11f5793feb4b9f98da0c95d93601b074eb91c038de8d69dbd64858d

SHA512
e6d467afa7a91caca250a1eb6cba8d6c95f4f46688732dbdfd9d173042f42c09ec56f8b447d15b014b046a40e300a566d57c0d6f31b00ca6730ce8ec1dc6a8fd

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
785b21c8ab8b1b9cd494711892fc8cd8

SHA1
f2dcf7c56d323794fd82f9560b2471ee5eb7c11d

SHA256
6fd8930c8eea4c3d277143a22875f41b83ffed42fa788c5b30f615e28a5622f0

SHA512
041e048979c415607503b088e8569c83e69df44ef5b97dce6afa8b43e8d7fb236a8048bd5ab0d82577e84c69b131ca1ce3649460b3220b8ac45447543a014077

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
46b965cd41e27870e027040d858d9dbc

SHA1
a0abba4c006f43e3d2db8cfcfc73b37433f6beeb

SHA256
6a532c72ef13f2bf27592051ddb9e834af475c2aa452ac127f075b9b793d9ca3

SHA512
ce8077df1b4c3c9db720afd41cadaf62a5b36a4d9fd327491025ff7dd8660c060ee55bb3b08b909e4a17f2e06abe862c43fe1c869be674bd59f23b263bb3fe23

Download Submit
\Windows\SYH6I0T\service.exe

Filesize
320KB

MD5
86fc61a08d4589ce206cedb15be0f0c5

SHA1
99665daca8b77d14e62c6352f0cc3db4acd4414f

SHA256
f1868a11c8918d673b32bbf16bee910211e79006f0727acdc0b5bbb1eb7b52aa

SHA512
695b8990c1d2e7d92a9d1b577ed91236e664b1ef52f745a797805093b932ecaadc9e0601213de8df6fb0f8053723110246d800b07cbe74e9ce2a1373be13377a

Download Submit
\Windows\SYH6I0T\service.exe

Filesize
320KB

MD5
86fc61a08d4589ce206cedb15be0f0c5

SHA1
99665daca8b77d14e62c6352f0cc3db4acd4414f

SHA256
f1868a11c8918d673b32bbf16bee910211e79006f0727acdc0b5bbb1eb7b52aa

SHA512
695b8990c1d2e7d92a9d1b577ed91236e664b1ef52f745a797805093b932ecaadc9e0601213de8df6fb0f8053723110246d800b07cbe74e9ce2a1373be13377a

Download Submit
\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
\Windows\SYH6I0T\smss.exe

Filesize
320KB

MD5
05ca0334ba4f26e36d308c11d4b3f8a1

SHA1
ec37614c57e2d7b3842f9e6d2fb75ea4c69cd369

SHA256
efa8c467778e2a5244c5522fbdafa2ecee19b7fb5f4a1ec75d1ca15c59379e4c

SHA512
44e7d1597af58ae5fc8dfedab85051daa75824fe556693c170385278f96874c4a6bc6934aae2990d2e4c4f9bbca987f9d695bc241be2940aac430c641750133a

Download Submit
\Windows\SYH6I0T\system.exe

Filesize
320KB

MD5
7f80f30115775f24c4055c31e0e8667d

SHA1
45f804930eb30e8a5c8bc1a5921f0859aaad73db

SHA256
05700d5fc0347eeb2d9fdad25b32ea82d37ec8ec584f359dfdb0123ab250c415

SHA512
633cf1c08cf70e22916ea3a818e8d6539fc2f29f19bf58849dcb14edf1822a61338018f0f5d65449a72278e79fad5551323683df4d919384bdfb0a9fa7845a42

Download Submit
memory/1044-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1044-47-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/1044-65-0x0000000003190000-0x00000000031E2000-memory.dmp

Filesize
328KB

Download
memory/1044-105-0x0000000003190000-0x00000000031E2000-memory.dmp

Filesize
328KB

Download
memory/1044-148-0x0000000003880000-0x00000000038D2000-memory.dmp

Filesize
328KB

Download
memory/1044-54-0x0000000003190000-0x00000000031E2000-memory.dmp

Filesize
328KB

Download
memory/1044-152-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2040-187-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2040-150-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2556-182-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2556-110-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2556-191-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2556-192-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2556-194-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2624-180-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2624-69-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2856-181-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2856-67-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads