8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

Analysis

max time kernel
155s
max time network
275s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Size

323KB
MD5

c90042e7f31c8a268a331c3f717c3b90
SHA1

707ccf07367221acebee88fc670cf39eb6c0038f
SHA256

8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6
SHA512

87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a
SSDEEP

6144:jBxeN/Tdx8YzL+4eBDgelLBL9C53TV5n+yNXavM:jBxe9dx8Yz6nhtL9C53TV5n+4av

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\""	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\""	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\""	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\""	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\""	K0L4B0R451.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kantuk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	4K51K4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	GoldenGhost.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	GoldenGhost.exe

Disables RegEdit via registry modification 12 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4K51K4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kantuk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4K51K4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 12 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	4K51K4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "cmd.exe /c del"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger = "notepad.exe"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	GoldenGhost.exe

Executes dropped EXE 10 IoCs

pid	Process
2804	winlogon.exe
844	winlogon.exe
1528	Kantuk.exe
920	4K51K4.exe
2136	K0L4B0R451.exe
2064	GoldenGhost.exe
240	Kantuk.exe
876	4K51K4.exe
2216	K0L4B0R451.exe
284	GoldenGhost.exe

Loads dropped DLL 20 IoCs

pid	Process
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2804	winlogon.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	K0L4B0R451.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	GoldenGhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	Kantuk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe"	K0L4B0R451.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	winlogon.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Kantuk.exe
File opened (read-only)	\??\E:	K0L4B0R451.exe
File opened (read-only)	\??\J:	K0L4B0R451.exe
File opened (read-only)	\??\U:	K0L4B0R451.exe
File opened (read-only)	\??\X:	K0L4B0R451.exe
File opened (read-only)	\??\E:	Kantuk.exe
File opened (read-only)	\??\P:	Kantuk.exe
File opened (read-only)	\??\V:	Kantuk.exe
File opened (read-only)	\??\I:	K0L4B0R451.exe
File opened (read-only)	\??\Y:	K0L4B0R451.exe
File opened (read-only)	\??\I:	Kantuk.exe
File opened (read-only)	\??\S:	Kantuk.exe
File opened (read-only)	\??\Z:	Kantuk.exe
File opened (read-only)	\??\H:	K0L4B0R451.exe
File opened (read-only)	\??\N:	Kantuk.exe
File opened (read-only)	\??\O:	Kantuk.exe
File opened (read-only)	\??\Y:	Kantuk.exe
File opened (read-only)	\??\M:	K0L4B0R451.exe
File opened (read-only)	\??\W:	K0L4B0R451.exe
File opened (read-only)	\??\L:	Kantuk.exe
File opened (read-only)	\??\X:	Kantuk.exe
File opened (read-only)	\??\L:	K0L4B0R451.exe
File opened (read-only)	\??\N:	K0L4B0R451.exe
File opened (read-only)	\??\O:	K0L4B0R451.exe
File opened (read-only)	\??\Z:	K0L4B0R451.exe
File opened (read-only)	\??\G:	Kantuk.exe
File opened (read-only)	\??\K:	Kantuk.exe
File opened (read-only)	\??\M:	Kantuk.exe
File opened (read-only)	\??\T:	Kantuk.exe
File opened (read-only)	\??\U:	Kantuk.exe
File opened (read-only)	\??\Q:	K0L4B0R451.exe
File opened (read-only)	\??\T:	K0L4B0R451.exe
File opened (read-only)	\??\H:	Kantuk.exe
File opened (read-only)	\??\G:	K0L4B0R451.exe
File opened (read-only)	\??\K:	K0L4B0R451.exe
File opened (read-only)	\??\R:	K0L4B0R451.exe
File opened (read-only)	\??\S:	K0L4B0R451.exe
File opened (read-only)	\??\V:	K0L4B0R451.exe
File opened (read-only)	\??\B:	Kantuk.exe
File opened (read-only)	\??\Q:	Kantuk.exe
File opened (read-only)	\??\W:	Kantuk.exe
File opened (read-only)	\??\B:	K0L4B0R451.exe
File opened (read-only)	\??\P:	K0L4B0R451.exe
File opened (read-only)	\??\J:	Kantuk.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	Kantuk.exe
File opened for modification	C:\autorun.inf	Kantuk.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GoldenGhost.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\K0L4B0R451.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\4K51K4.exe	winlogon.exe
File created	C:\Windows\SysWOW64\Asli.ico	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\Windows_3D.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\GoldenGhost.exe.tmp	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\Rar.ico	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\4K51K4.exe.tmp	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\Shell32.com.tmp	winlogon.exe
File created	C:\Windows\SysWOW64\Rar.ico	winlogon.exe
File created	C:\Windows\SysWOW64\Shell32.com	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\GoldenGhost.exe.tmp	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\Word.ico	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\K0L4B0R451.exe.tmp	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico	winlogon.exe
File created	C:\Windows\SysWOW64\Word.ico	winlogon.exe
File created	C:\Windows\SysWOW64\Kantuk.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\Kantuk.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\GoldenGhost.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\Kantuk.exe.tmp	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\K0L4B0R451.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\GoldenGhost.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\4K51K4.exe.tmp	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\K0L4B0R451.exe.tmp	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\Player.ico	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\4K51K4.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\4K51K4.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\Kantuk.exe.tmp	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\Folder.ico	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\Player.ico	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\Windows_3D.scr	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\Shell32.com	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\Kantuk.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\Shell32.com	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\K0L4B0R451.exe	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\Shell32.com.tmp	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File created	C:\Windows\SysWOW64\Asli.ico	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp	winlogon.exe
File created	C:\Windows\SysWOW64\Folder.ico	winlogon.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\K0L4B0R451.jpg"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\K0L4B0R451.jpg	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 45 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s1159 = "K0L4B0R451"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s2359 = "K0L4B0R451"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr"	K0L4B0R451.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	K0L4B0R451.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s2359 = "K0L4B0R451"	GoldenGhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s1159 = "K0L4B0R451"	Kantuk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	4K51K4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s2359 = "K0L4B0R451"	4K51K4.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\	K0L4B0R451.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\WallpaperStyle = "0"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s2359 = "K0L4B0R451"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\	4K51K4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s1159 = "K0L4B0R451"	GoldenGhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr"	4K51K4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100"	K0L4B0R451.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Kantuk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s2359 = "K0L4B0R451"	Kantuk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100"	4K51K4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s1159 = "K0L4B0R451"	4K51K4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr"	GoldenGhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	GoldenGhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100"	GoldenGhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\	GoldenGhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr"	Kantuk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s2359 = "K0L4B0R451"	K0L4B0R451.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\	GoldenGhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\TileWallpaper = "0"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s1159 = "K0L4B0R451"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100"	Kantuk.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\	K0L4B0R451.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\	Kantuk.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\	Kantuk.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\Desktop\	4K51K4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Control Panel\International\s1159 = "K0L4B0R451"	K0L4B0R451.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	4K51K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe"	K0L4B0R451.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	GoldenGhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe"	Kantuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
920	4K51K4.exe
2064	GoldenGhost.exe
1528	Kantuk.exe
2136	K0L4B0R451.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
2804	winlogon.exe
844	winlogon.exe
1528	Kantuk.exe
920	4K51K4.exe
2136	K0L4B0R451.exe
2064	GoldenGhost.exe
240	Kantuk.exe
876	4K51K4.exe
2216	K0L4B0R451.exe
284	GoldenGhost.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2804	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	27
PID 2488 wrote to memory of 2804	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	27
PID 2488 wrote to memory of 2804	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	27
PID 2488 wrote to memory of 2804	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	27
PID 2804 wrote to memory of 844	2804	winlogon.exe	28
PID 2804 wrote to memory of 844	2804	winlogon.exe	28
PID 2804 wrote to memory of 844	2804	winlogon.exe	28
PID 2804 wrote to memory of 844	2804	winlogon.exe	28
PID 2804 wrote to memory of 1528	2804	winlogon.exe	29
PID 2804 wrote to memory of 1528	2804	winlogon.exe	29
PID 2804 wrote to memory of 1528	2804	winlogon.exe	29
PID 2804 wrote to memory of 1528	2804	winlogon.exe	29
PID 2804 wrote to memory of 920	2804	winlogon.exe	30
PID 2804 wrote to memory of 920	2804	winlogon.exe	30
PID 2804 wrote to memory of 920	2804	winlogon.exe	30
PID 2804 wrote to memory of 920	2804	winlogon.exe	30
PID 2804 wrote to memory of 2136	2804	winlogon.exe	31
PID 2804 wrote to memory of 2136	2804	winlogon.exe	31
PID 2804 wrote to memory of 2136	2804	winlogon.exe	31
PID 2804 wrote to memory of 2136	2804	winlogon.exe	31
PID 2804 wrote to memory of 2064	2804	winlogon.exe	32
PID 2804 wrote to memory of 2064	2804	winlogon.exe	32
PID 2804 wrote to memory of 2064	2804	winlogon.exe	32
PID 2804 wrote to memory of 2064	2804	winlogon.exe	32
PID 2488 wrote to memory of 240	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	33
PID 2488 wrote to memory of 240	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	33
PID 2488 wrote to memory of 240	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	33
PID 2488 wrote to memory of 240	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	33
PID 2488 wrote to memory of 876	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	34
PID 2488 wrote to memory of 876	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	34
PID 2488 wrote to memory of 876	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	34
PID 2488 wrote to memory of 876	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	34
PID 2488 wrote to memory of 2216	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	35
PID 2488 wrote to memory of 2216	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	35
PID 2488 wrote to memory of 2216	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	35
PID 2488 wrote to memory of 2216	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	35
PID 2488 wrote to memory of 284	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	36
PID 2488 wrote to memory of 284	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	36
PID 2488 wrote to memory of 284	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	36
PID 2488 wrote to memory of 284	2488	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe	36

System policy modification 1 TTPs 48 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	GoldenGhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	4K51K4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Kantuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	K0L4B0R451.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	Kantuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	GoldenGhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	4K51K4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	K0L4B0R451.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	GoldenGhost.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c90042e7f31c8a268a331c3f717c3b90.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2488
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2804
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:844
- - C:\Windows\SysWOW64\Kantuk.exe
    C:\Windows\system32\Kantuk.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Sets file execution options in registry
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops autorun.inf file
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1528
- - C:\Windows\SysWOW64\4K51K4.exe
    C:\Windows\system32\4K51K4.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Sets file execution options in registry
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:920
- - C:\Windows\SysWOW64\K0L4B0R451.exe
    C:\Windows\system32\K0L4B0R451.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Sets file execution options in registry
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2136
- - C:\Windows\SysWOW64\GoldenGhost.exe
    C:\Windows\system32\GoldenGhost.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Sets file execution options in registry
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2064
- C:\Windows\SysWOW64\Kantuk.exe
  C:\Windows\system32\Kantuk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:240
- C:\Windows\SysWOW64\4K51K4.exe
  C:\Windows\system32\4K51K4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:876
- C:\Windows\SysWOW64\K0L4B0R451.exe
  C:\Windows\system32\K0L4B0R451.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2216
- C:\Windows\SysWOW64\GoldenGhost.exe
  C:\Windows\system32\GoldenGhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Aut0exec.bat

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Aut0exec.bat.tmp

Filesize
323KB

MD5
0b3d82f0254daa9483fb4faa680991c1

SHA1
c9c68000633014931c37eed9fc5c75fe2ac2e34b

SHA256
205ff11d77adafdc32a1e7762c0258e5a469d231cf5c485845f8f77ef63905fd

SHA512
d19e0d2ec40327ee853a3d7cbd8ac80b89c6f843e3f70de505aa52dae1fa333423bb6e65cae03e7486c59df2cb0571ca712477bd4878ac97ae3e98df39577841

Download Submit
C:\Aut0exec.bat.tmp

Filesize
323KB

MD5
fb62828fe9a0fe84575c46458329ff73

SHA1
1121c3bcf23b1d5faff560793c06f5e2d428ec01

SHA256
9142f30b4a2825d32a5ae2542f0b801efded14ba3580b09b2c90584b34836df3

SHA512
7254b5e5db52a1c56deb684e6ca5bf6814b386911dcfa1de08da63cea96b0a07a8ef466db2c285be1a278ca64c33b4a76d0ed57fb0729c8e7154e57e5c85aaff

Download Submit
C:\Aut0exec.bat.tmp

Filesize
323KB

MD5
be322326013e6a19c1eadf1354dc1326

SHA1
7fb211e296a45da6f6b2e518340b66a0a99bd979

SHA256
97544c64b272788a1fa52af500db0489d189212933c4fe1a9ba803c03a6dc6ab

SHA512
3c5ee43c4e893a8f753333b5dc3b1b5571ae316f37826a0ac4c65125a8ad2c7e21217858fd69553d0b08dcc36e5d7b9688133af81ba98e18367c20551c78c6e9

Download Submit
C:\JPG.ico

Filesize
2KB

MD5
62b7610403ea3ac4776df9eb93bf4ba4

SHA1
b4a6cd17516f8fba679f15eda654928dc44dc502

SHA256
b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29

SHA512
fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif.tmp

Filesize
323KB

MD5
81b331c75a10c4736f940c117b3cee16

SHA1
8349db9bd34216a75667a884e5ba98950f7537e1

SHA256
4cbac48b90cecd5e68db667be307cdb68388cfc56589973e7f70a69de954ef30

SHA512
6e46aa610ffa619594a31a5c8be9a93c45106b44604f8221e55afb348f36bc941f4d3aedcdb0f71aad8c296db2db4bcfa5a383c89729672b99e2c570567e8477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp

Filesize
323KB

MD5
1727b907f67c39d629b058adc66228aa

SHA1
a7490eb22c82d7bc264112063b9b9a77dacf363a

SHA256
d21656dd2820a02205b4dd619258103f4af2b5dd70c51ffe54fb5ae3272c3493

SHA512
947fd445650a5a578234fe358e5a11fb44fa305d820660c71643cc2aacc9bc350b25449dc44070e6a4bc4454c27c38cf47ec8324157154542fa5511f9d394b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp

Filesize
323KB

MD5
8f28de1cf5facb3b0df62f59057ee232

SHA1
baddd7813b73e1ec22e417362ee540ec2791f1a1

SHA256
4ce4fab5ecb04f4b6f4ef9552bb4b5f9e783306d4207bef2bb4d5c6a834f7f0e

SHA512
2c4afc1781a7ae19e52efbb608c2287729e96802648d4d7cf47d0576e98a2b33e2aaad71ba87f62dcf379d5bb814a86ffe13279814e7430d18967070a77be538

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
C:\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
C:\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
C:\Windows\SysWOW64\4K51K4.exe.tmp

Filesize
323KB

MD5
8986d66f0f5cac9e37caa784b82943d0

SHA1
6b17dfe8e46c6459cccca377af45253195975aec

SHA256
a59bd3213892aca1974cf49f87d9561ff8b64227961627e31deaad3578ed6c45

SHA512
4bdcdd4b83475503db9207f6361248a518a410ad7b5466d48f260ee830fcb1b6ba780b5327d16ea68e5eb868e97e74fbdad8f7bd437aa0a1744653cc2b4b6b30

Download Submit
C:\Windows\SysWOW64\4K51K4.exe.tmp

Filesize
323KB

MD5
28de18d0516834e0f8c361ff095b95c5

SHA1
747edd8456161128d161ed1ac00d19804ba617c3

SHA256
9cda2c5f9a6ed0c9e59d8b42723bc40a761c10241b85770eb08e1b32c4e6f98e

SHA512
9a6a7dadb7ebd027b3f10b5933e76bcbc32ae844125dd445ca0a8d8e5a9b7f400fc0920f707d8bec6bc66386f18af426f662651a236020aa0e1c028d97442264

Download Submit
C:\Windows\SysWOW64\Folder.ico

Filesize
7KB

MD5
d7f9d9553c172cba8825fa161e8e9851

SHA1
e45bdc6609d9d719e1cefa846f17d3d66332a3a0

SHA256
cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086

SHA512
a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe.tmp

Filesize
323KB

MD5
dea20c48415ea3370128e35ceef93726

SHA1
44e85cc6293de5ef19972861f853090eb2824e31

SHA256
09974e9abc30c75c898c5ef4f1f4c827a09baa9f5e2180a1ae703aae61cce4b5

SHA512
55b3a3815d3e57a4ce8200a8d1c24b11f094129c60276ec4b23be97e5d34a1b830b6c59bf90e78863c08089d1d054867cb9772fbc88ed6ae0e51698582746d14

Download Submit
C:\Windows\SysWOW64\GoldenGhost.exe.tmp

Filesize
323KB

MD5
1973fce1a2cd76143d8f7ca19cbc81b6

SHA1
3f56717d9e873179310925872448d765730613b5

SHA256
beb5900e889f3611d93a0d8712b8feaa0b39ee9faf7a51b6e85437aebc4d86f0

SHA512
e09673a9790b9b45bb7fb7d630f9a0b9c4f22703a66d1ad1c12e371a05a086b4689bc77391d11e5dee9fb22c25be2618bae751191897a6c7ac1ee52b32d83fee

Download Submit
C:\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
C:\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
C:\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
C:\Windows\SysWOW64\K0L4B0R451.exe.tmp

Filesize
323KB

MD5
34d6941f2db8128e6a7d5430631d79eb

SHA1
578f0a504d69a82d5d4bdd682dacb74db3ab0ed4

SHA256
1de4118d1b0c81f81ab41c352c5397005c9fdac81a10763b87b97facc75d1bfa

SHA512
f7f7985b457809075e9e5f34b2e833ecc621630ea8c0cba96c1559ab3eaf7ebaaa3985ea9442d3c497cd540c156422f00193e75277c33cfb85f9cbd40eaedada

Download Submit
C:\Windows\SysWOW64\K0L4B0R451.exe.tmp

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
C:\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
C:\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
C:\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
C:\Windows\SysWOW64\Kantuk.exe.tmp

Filesize
323KB

MD5
1e4547e63e30e9491349e97d91ae7c90

SHA1
8101152d11875275e565dbb90b76309b39e1c3f9

SHA256
3d6792e0c8142e9f208ca860081b0baa3d18040f9636ee00900ec57593f1aa10

SHA512
7e365a4d703e2539d9d6923b77315afb4b62468429d1eb653c9f66cd69277b17afe1fe86f5800877a7d347311e66e5de346d2e25eb4186b393fdba95ff27374d

Download Submit
C:\Windows\SysWOW64\Kantuk.exe.tmp

Filesize
323KB

MD5
96770f97d9e7ab77bbca0a6b98a64504

SHA1
aaa0de6fc8c611c40e39757d1b3ff9bd3bceb336

SHA256
db83a5da649435c91c0a72d079b9f2c1eb922144ba750468d79a5d722d7e9207

SHA512
17330233509854843bb78aa14d9dc928ec68fbcba2f3571ed0c7a99dff6a32e9ea3907d869dec23936c887cd018692e2a749dffa8848a945ad9a18e0c3d2bf07

Download Submit
C:\Windows\SysWOW64\Player.ico

Filesize
2KB

MD5
43be35d4fb3ebc6ca0970f05365440e3

SHA1
87bc28e5d9a6ab0c79a07118ca578726ce61b1bc

SHA256
5a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5

SHA512
b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395

Download Submit
C:\Windows\SysWOW64\Shell32.com

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\Shell32.com.tmp

Filesize
323KB

MD5
3fc6b71d228106f6fa85cf509969b6cb

SHA1
b7eeb68c0c2839b7ddcf5508fe83c317fe17ee92

SHA256
7ad80b66f6bbc8c52117e997c657a059fa47923da92a5c0931f3ee2da8fba70c

SHA512
01f630d4dd75cf3576750618efd62e50550d9ddb8fd59ebdb97ae2835dd32510ffc2e96ff2912a103672c106883eae7080d2a56e812eff0c839278c741f3f9bb

Download Submit
C:\Windows\SysWOW64\Shell32.com.tmp

Filesize
323KB

MD5
c7cf5263fe6ef85aab2dc5e9ff913dd3

SHA1
5bfd5c1d3ce6d83c8df91660318870283c0c6833

SHA256
06afa9a334018b474153a39af12a8cb27841100c59c8ea4282a88f4f5e7ee7fb

SHA512
38a9ca32859d8c7529b150b067941e5942fdb4201ae544d00e39356461c912fa72b2a028e16bbe37b4d036eb1125c4cd1ba9566f43cf313d03325de5d7e1f9b5

Download Submit
C:\Windows\SysWOW64\Word.ico

Filesize
3KB

MD5
8482935ff2fab6025b44b5a23c750480

SHA1
d770c46d210c0fd302fa035a6054f5ac19f3bd13

SHA256
dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c

SHA512
00c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp

Filesize
323KB

MD5
23b4e1823e7a68b5eacf19badc4a29b7

SHA1
df3700bc6e2902c0bca4cc59c81ef17dcb6343ea

SHA256
57d57a08e21d8246b8f58bed49a234a2bab5235176a5a85ec8ae5379860fe62a

SHA512
6a32f51dc3ad7bee5b4c178661855d79fa874b7de6eda47f396f6541ba0f859e18fe194d58b7686fb1ae7b68cff4f7ff66e462007d87351abd6609861ac45d1d

Download Submit
\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
\Windows\SysWOW64\4K51K4.exe

Filesize
323KB

MD5
1eaf8f5b37c796ba056bf9a1931eace0

SHA1
5ebda684b88dcc4cd7ea76d60148f56d29cbbd48

SHA256
59d9fe3ae10efff411bff3f7dc9976758bbc1c00ee7e0d33be448cf7f4417230

SHA512
25b97d1890573973d0c304ff4c939117e9dd65d6801da8803eb0bc8143a8248ccf9efba78fcf45361d8e3c477606b6876992961bd30199f5c98e9e26fb1cf289

Download Submit
\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
\Windows\SysWOW64\GoldenGhost.exe

Filesize
323KB

MD5
2d007add0ebec848e954ae6badd9a4c4

SHA1
ebecc47f76c1d84c625763f99b24b4bc5b1408fd

SHA256
0712491d73896fe3d1913cbbc3917cccfe082e96fb4425bb73302d196c27c83d

SHA512
03fc5e316c99eb9b2d54e02f271ef9416ddf9373a8be36ecfa12a7480b37eb7eee56f6c71fb73c7f37deb2e7b569c4afa63e42b0ed621487df27eecff73d15a3

Download Submit
\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
\Windows\SysWOW64\K0L4B0R451.exe

Filesize
323KB

MD5
01236e8d602b1e7fc6d38cf420cf7218

SHA1
fe317abedce948ad8acba2d51fa85c7522d77c61

SHA256
56b5e1fa46e55a9228bfdca721b6e4be130d5deff9aa79d13d903d3f76b0c666

SHA512
8cf748800f2beae429ba4a159b63a1dea1eb0f121c026a7a0c063f19fcb4e5e644fc1bec0aea6f6110c359296f1a313f33bde24d69e74bb928456dfe1b2e4cf6

Download Submit
\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
\Windows\SysWOW64\Kantuk.exe

Filesize
323KB

MD5
01a5607cb2fa355c7df5f9fe0c7f9706

SHA1
20c0ce8d22f1a49e3e337cac672de8e564e7f67e

SHA256
0fc6c63dfc1060e6b716479ce044e50e48cd3dbc967d989a30da6a86f8fe48e6

SHA512
7e6109efba27d0f98442068d08d684a7110a1f6de2fc7699fed1230a6386257693921a892577270d07e3b30374dee1f6189cb3e8e3aa40c1770ced4be31733c3

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
323KB

MD5
c90042e7f31c8a268a331c3f717c3b90

SHA1
707ccf07367221acebee88fc670cf39eb6c0038f

SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6

SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a

Download Submit
memory/920-287-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1528-264-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2064-303-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2136-293-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2488-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads