Analysis
-
max time kernel
59s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Resource
win7-20231023-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
NEAS.c90042e7f31c8a268a331c3f717c3b90.exe
-
Size
323KB
-
MD5
c90042e7f31c8a268a331c3f717c3b90
-
SHA1
707ccf07367221acebee88fc670cf39eb6c0038f
-
SHA256
8cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6
-
SHA512
87dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a
-
SSDEEP
6144:jBxeN/Tdx8YzL+4eBDgelLBL9C53TV5n+yNXavM:jBxe9dx8Yz6nhtL9C53TV5n+4av
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" K0L4B0R451.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" GoldenGhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe -
Disables RegEdit via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe -
Disables use of System Restore points 1 TTPs
-
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger = "notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe Kantuk.exe -
Executes dropped EXE 10 IoCs
pid Process 1832 winlogon.exe 3584 Kantuk.exe 4724 winlogon.exe 1440 Kantuk.exe 4140 4K51K4.exe 4444 4K51K4.exe 4740 K0L4B0R451.exe 2320 K0L4B0R451.exe 4212 GoldenGhost.exe 3356 GoldenGhost.exe -
Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" GoldenGhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe -
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Kantuk.exe File opened (read-only) \??\J: Kantuk.exe File opened (read-only) \??\N: Kantuk.exe File opened (read-only) \??\X: K0L4B0R451.exe File opened (read-only) \??\S: Kantuk.exe File opened (read-only) \??\B: K0L4B0R451.exe File opened (read-only) \??\L: K0L4B0R451.exe File opened (read-only) \??\O: K0L4B0R451.exe File opened (read-only) \??\W: K0L4B0R451.exe File opened (read-only) \??\Y: K0L4B0R451.exe File opened (read-only) \??\O: Kantuk.exe File opened (read-only) \??\Q: K0L4B0R451.exe File opened (read-only) \??\T: K0L4B0R451.exe File opened (read-only) \??\N: K0L4B0R451.exe File opened (read-only) \??\P: K0L4B0R451.exe File opened (read-only) \??\L: Kantuk.exe File opened (read-only) \??\Q: Kantuk.exe File opened (read-only) \??\R: Kantuk.exe File opened (read-only) \??\H: K0L4B0R451.exe File opened (read-only) \??\I: K0L4B0R451.exe File opened (read-only) \??\J: K0L4B0R451.exe File opened (read-only) \??\M: Kantuk.exe File opened (read-only) \??\E: K0L4B0R451.exe File opened (read-only) \??\G: K0L4B0R451.exe File opened (read-only) \??\K: K0L4B0R451.exe File opened (read-only) \??\B: Kantuk.exe File opened (read-only) \??\H: Kantuk.exe File opened (read-only) \??\T: Kantuk.exe File opened (read-only) \??\U: Kantuk.exe File opened (read-only) \??\X: Kantuk.exe File opened (read-only) \??\Y: Kantuk.exe File opened (read-only) \??\U: K0L4B0R451.exe File opened (read-only) \??\V: K0L4B0R451.exe File opened (read-only) \??\E: Kantuk.exe File opened (read-only) \??\G: Kantuk.exe File opened (read-only) \??\P: Kantuk.exe File opened (read-only) \??\V: Kantuk.exe File opened (read-only) \??\R: K0L4B0R451.exe File opened (read-only) \??\S: K0L4B0R451.exe File opened (read-only) \??\K: Kantuk.exe File opened (read-only) \??\W: Kantuk.exe File opened (read-only) \??\Z: Kantuk.exe File opened (read-only) \??\M: K0L4B0R451.exe File opened (read-only) \??\Z: K0L4B0R451.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf Kantuk.exe File opened for modification C:\autorun.inf Kantuk.exe -
Drops file in System32 directory 47 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\4K51K4.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\Shell32.com winlogon.exe File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp winlogon.exe File created C:\Windows\SysWOW64\Player.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Rar.ico NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\Windows_3D.scr NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ winlogon.exe File created C:\Windows\SysWOW64\Kantuk.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\Windows_3D.scr winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico winlogon.exe File created C:\Windows\SysWOW64\Folder.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Folder.ico NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Word.ico NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Word.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe winlogon.exe File created C:\Windows\SysWOW64\Rar.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\Shell32.com NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\K0L4B0R451.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Shell32.com NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Asli.ico NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Asli.ico winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\GoldenGhost.exe NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File created C:\Windows\SysWOW64\Player.ico NEAS.c90042e7f31c8a268a331c3f717c3b90.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp winlogon.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\K0L4B0R451.jpg" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\K0L4B0R451.jpg NEAS.c90042e7f31c8a268a331c3f717c3b90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 45 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\ winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s1159 = "K0L4B0R451" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\ Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s2359 = "K0L4B0R451" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s1159 = "K0L4B0R451" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s2359 = "K0L4B0R451" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" GoldenGhost.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\ NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s1159 = "K0L4B0R451" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s2359 = "K0L4B0R451" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\ 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s2359 = "K0L4B0R451" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s2359 = "K0L4B0R451" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\TileWallpaper = "0" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s2359 = "K0L4B0R451" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s1159 = "K0L4B0R451" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" GoldenGhost.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\ GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s1159 = "K0L4B0R451" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\s1159 = "K0L4B0R451" Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\WallpaperStyle = "0" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" K0L4B0R451.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\ K0L4B0R451.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\ NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell NEAS.c90042e7f31c8a268a331c3f717c3b90.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 4140 4K51K4.exe 3584 Kantuk.exe 3356 GoldenGhost.exe 4740 K0L4B0R451.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 1832 winlogon.exe 4724 winlogon.exe 3584 Kantuk.exe 1440 Kantuk.exe 4140 4K51K4.exe 4444 4K51K4.exe 4740 K0L4B0R451.exe 2320 K0L4B0R451.exe 4212 GoldenGhost.exe 3356 GoldenGhost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3512 wrote to memory of 1832 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 89 PID 3512 wrote to memory of 1832 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 89 PID 3512 wrote to memory of 1832 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 89 PID 3512 wrote to memory of 3584 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 90 PID 3512 wrote to memory of 3584 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 90 PID 3512 wrote to memory of 3584 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 90 PID 1832 wrote to memory of 4724 1832 winlogon.exe 91 PID 1832 wrote to memory of 4724 1832 winlogon.exe 91 PID 1832 wrote to memory of 4724 1832 winlogon.exe 91 PID 1832 wrote to memory of 1440 1832 winlogon.exe 93 PID 1832 wrote to memory of 1440 1832 winlogon.exe 93 PID 1832 wrote to memory of 1440 1832 winlogon.exe 93 PID 3512 wrote to memory of 4140 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 94 PID 3512 wrote to memory of 4140 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 94 PID 3512 wrote to memory of 4140 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 94 PID 1832 wrote to memory of 4444 1832 winlogon.exe 96 PID 1832 wrote to memory of 4444 1832 winlogon.exe 96 PID 1832 wrote to memory of 4444 1832 winlogon.exe 96 PID 3512 wrote to memory of 4740 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 97 PID 3512 wrote to memory of 4740 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 97 PID 3512 wrote to memory of 4740 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 97 PID 1832 wrote to memory of 2320 1832 winlogon.exe 99 PID 1832 wrote to memory of 2320 1832 winlogon.exe 99 PID 1832 wrote to memory of 2320 1832 winlogon.exe 99 PID 1832 wrote to memory of 4212 1832 winlogon.exe 100 PID 1832 wrote to memory of 4212 1832 winlogon.exe 100 PID 1832 wrote to memory of 4212 1832 winlogon.exe 100 PID 3512 wrote to memory of 3356 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 101 PID 3512 wrote to memory of 3356 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 101 PID 3512 wrote to memory of 3356 3512 NEAS.c90042e7f31c8a268a331c3f717c3b90.exe 101 -
System policy modification 1 TTPs 48 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NEAS.c90042e7f31c8a268a331c3f717c3b90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" K0L4B0R451.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c90042e7f31c8a268a331c3f717c3b90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c90042e7f31c8a268a331c3f717c3b90.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3512 -
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1832 -
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
C:\Windows\SysWOW64\Kantuk.exeC:\Windows\system32\Kantuk.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
C:\Windows\SysWOW64\4K51K4.exeC:\Windows\system32\4K51K4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4444
-
-
C:\Windows\SysWOW64\K0L4B0R451.exeC:\Windows\system32\K0L4B0R451.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320
-
-
C:\Windows\SysWOW64\GoldenGhost.exeC:\Windows\system32\GoldenGhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4212
-
-
-
C:\Windows\SysWOW64\Kantuk.exeC:\Windows\system32\Kantuk.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3584
-
-
C:\Windows\SysWOW64\4K51K4.exeC:\Windows\system32\4K51K4.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4140
-
-
C:\Windows\SysWOW64\K0L4B0R451.exeC:\Windows\system32\K0L4B0R451.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4740
-
-
C:\Windows\SysWOW64\GoldenGhost.exeC:\Windows\system32\GoldenGhost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3356
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5fb62828fe9a0fe84575c46458329ff73
SHA11121c3bcf23b1d5faff560793c06f5e2d428ec01
SHA2569142f30b4a2825d32a5ae2542f0b801efded14ba3580b09b2c90584b34836df3
SHA5127254b5e5db52a1c56deb684e6ca5bf6814b386911dcfa1de08da63cea96b0a07a8ef466db2c285be1a278ca64c33b4a76d0ed57fb0729c8e7154e57e5c85aaff
-
Filesize
323KB
MD559ddc6de857ad357f3f9d6244e66de10
SHA1b9111b6124b93be02b43b7ff373f5f4b0e0fffce
SHA256ddf063c609bc9dcd601d62890faf0f8aacb89de01c0ea97689976399196e0a27
SHA5123c7cdf984aad74cc166c667419c6daefe89bc0fe8d384f96509c19e17e6094cef8b67aae001cff3c1e4550f42103945c0e520cd59e05276d183651de5a3c3f74
-
Filesize
323KB
MD52e31817170ec63b662c0d770d04409ed
SHA1a7ceee30daae6815b2218e06fee0a1368521b84f
SHA2567a6ab0a907cf1243cc7b8399657de128e395c2ec1a2d998c165a23e70d4731bb
SHA512fe29c5f7132b63870b355ebaea480802fadcc5b75776eef76a63373993f5c98c1dac1b1e4ca2de8f95e0673b13ca1bd63487569d9c6941b2f9184f0a8c5c37ff
-
Filesize
323KB
MD5e768b210435bc92a5f9a9193f489b8cb
SHA187b3958085fbd2d832ed034395a9dc2eaca9669c
SHA25693c8081543bb2d769dfaaf43745548616406e491115557e11c3a59308c087350
SHA512432291fee72cf20b1d1d7c1fefc83f989e2eb3e8b10246bc3c7fe164f371c5e9036e9fdca156b7b5598b44532a59035f406ca2a9593d72ef67aff986fcd83af5
-
Filesize
323KB
MD52d670fabd7f9021cc1972eba387ccc05
SHA1840cec15c39a01715ecb053dbd1da617a3f80855
SHA2568dfd884f407f46054c21b520cfc53e95c219885c2b9f88074a116797743a84ca
SHA512ce28724af527a63b88491ae63d0b3ff4be5603e5fb6b033b15c130a6c1ac704be8692f691dbe0b2532d9ebad22793849d87cb384c44bdda0fbfe90bd0beb084f
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD590b43b020affa28ed9608eb2da15a40c
SHA119f64f942814733a15ee220035110a9e3fcf1d94
SHA256ab3a53f4979329300e42cbc5d8244b461972214851d560c0bf2398af7b038ef6
SHA5120458a5fd386f9aa99ef27d0349ce6d3c08d1998cb6a4e47af2671535cd6dc2908310b846a416781f625d56ae86b224750ec7855e253c5a4f08bb5bca19a819f8
-
Filesize
323KB
MD52bf51d9f1bab0c4f0a53e430dff3f8a8
SHA1782e117c785ebb672e7a88c1cdadb75a0eb395e0
SHA256cde1c0d6d7c32056d918b8a945c3d1456a74fadf9fc6d1604b82abc43e0e4600
SHA5121f522665c97e5a2ff8e23728e6d0a45df69d501ede0ec8ef03c242d2baf101ca2623c365e86d7f2283b35e1b98a9deb4402655358b882357788d2d4293f9cf4b
-
Filesize
323KB
MD562fd6347bd97a8e24ada8606e115d39b
SHA10f9d0e36e7860c3a15ba25c92b850ec2285ed250
SHA25698d91c3c79c7eae2efd271d2791602d850726e201eb6b99c28185cc2dfad7660
SHA5126f2727599123dbe1489fa91823e78ddb114592d204481a2355a0aac3912568c22ca0091080faddf4e9e5c47c27fdd882eb08f08962d9d42853ca25bfe09c6f1d
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD52fe45e2bb624368ce351c4969e26b8f3
SHA1cf43f5edf270d78878b28d93c5e70c291d3b3cb5
SHA25639626935fdd9f2f038a3534d3c349d0fe65b26680ef0cfc4c643344a69206fbb
SHA51250b441fe97ea31c9cfcbf2a886d416b28e3105d7ec63da70ac1c82ff7fb6b8e7aeb466270356a1183fead663f864e3748161f65da3cc27704e758e6d0f7b2b82
-
Filesize
323KB
MD52fe45e2bb624368ce351c4969e26b8f3
SHA1cf43f5edf270d78878b28d93c5e70c291d3b3cb5
SHA25639626935fdd9f2f038a3534d3c349d0fe65b26680ef0cfc4c643344a69206fbb
SHA51250b441fe97ea31c9cfcbf2a886d416b28e3105d7ec63da70ac1c82ff7fb6b8e7aeb466270356a1183fead663f864e3748161f65da3cc27704e758e6d0f7b2b82
-
Filesize
323KB
MD52fe45e2bb624368ce351c4969e26b8f3
SHA1cf43f5edf270d78878b28d93c5e70c291d3b3cb5
SHA25639626935fdd9f2f038a3534d3c349d0fe65b26680ef0cfc4c643344a69206fbb
SHA51250b441fe97ea31c9cfcbf2a886d416b28e3105d7ec63da70ac1c82ff7fb6b8e7aeb466270356a1183fead663f864e3748161f65da3cc27704e758e6d0f7b2b82
-
Filesize
323KB
MD528de18d0516834e0f8c361ff095b95c5
SHA1747edd8456161128d161ed1ac00d19804ba617c3
SHA2569cda2c5f9a6ed0c9e59d8b42723bc40a761c10241b85770eb08e1b32c4e6f98e
SHA5129a6a7dadb7ebd027b3f10b5933e76bcbc32ae844125dd445ca0a8d8e5a9b7f400fc0920f707d8bec6bc66386f18af426f662651a236020aa0e1c028d97442264
-
Filesize
323KB
MD5e305d16d7afad665e1f0982696c6b616
SHA155ea8a843c1510b050478cdfe1314c5a00b43260
SHA256599e2a810f315ef7af0a594f8330b2decbc82bd991299798688c6412e729ba6c
SHA512fab8e6eb384174e205ee1145716f0457f7cb2e7f8d3d03c4985ff0a9c6a4a9e1b9ac8ace83976b024f46fab2e006c67fd2f5789e6c4cdbbd3d10eb005ee9f980
-
Filesize
323KB
MD5c6f1121e5570290ca8d401ccf23b05c6
SHA1e33ec764c5eb9b06b3b782fbb0f3598dad9a6552
SHA2564f2dc0a6c4048ace0d3932e0120c5408e3c6657e5b5c32ef5ae4cd0fc2720e4f
SHA512e3c24b5a8662b9b907206e58795d21af2d9d3fe54b81b1259bd923fbffa18ffbbdacd5f75d6700befc835a6f39b803ffcb227447bc37e3463aedc1c857a73885
-
Filesize
7KB
MD5d7f9d9553c172cba8825fa161e8e9851
SHA1e45bdc6609d9d719e1cefa846f17d3d66332a3a0
SHA256cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086
SHA512a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5c39f4f57b45b166a9658dcd1de02442d
SHA1b3edc09209d992973e43d7a0efaf3221fbe98a68
SHA2567cf89df579733bbf3ea9935c8ddf78954b114fc8f94549a902c68a9a2b401f59
SHA5129eb86c156e84f2f57541c26b75b81df7a8feaf28983f485cdda3a4c16231e9b08d86716369cb5c9638267ec587058a111962807a94b3cf20c254f8f6cb6a5ac0
-
Filesize
323KB
MD5c39f4f57b45b166a9658dcd1de02442d
SHA1b3edc09209d992973e43d7a0efaf3221fbe98a68
SHA2567cf89df579733bbf3ea9935c8ddf78954b114fc8f94549a902c68a9a2b401f59
SHA5129eb86c156e84f2f57541c26b75b81df7a8feaf28983f485cdda3a4c16231e9b08d86716369cb5c9638267ec587058a111962807a94b3cf20c254f8f6cb6a5ac0
-
Filesize
323KB
MD5c39f4f57b45b166a9658dcd1de02442d
SHA1b3edc09209d992973e43d7a0efaf3221fbe98a68
SHA2567cf89df579733bbf3ea9935c8ddf78954b114fc8f94549a902c68a9a2b401f59
SHA5129eb86c156e84f2f57541c26b75b81df7a8feaf28983f485cdda3a4c16231e9b08d86716369cb5c9638267ec587058a111962807a94b3cf20c254f8f6cb6a5ac0
-
Filesize
323KB
MD5c90042e7f31c8a268a331c3f717c3b90
SHA1707ccf07367221acebee88fc670cf39eb6c0038f
SHA2568cd0e68f3536147e63202ede9f4bcd5ccb07eecf719fd6d68adcd377a2bf45e6
SHA51287dfe51a70c39f9ef8aabf657ab0b04354d2d513083c8f6211c12cd9d90c055c697fd254958b2058b574aa1d6596d2d4bd60cddc4a3b5fb2fcd6398b07e4890a
-
Filesize
323KB
MD546d58c288f5759b0e92639f20559cc80
SHA18983289287fa48b59edeaeeaca12b97191a04084
SHA256ba6ed688b92ce47fd81a90259c60c96dadd4affb0eab2a60a88d1d47d1194d55
SHA512ea13ee6ed35397e9d09104a6221ddcb711294f7932ddf048f121ed970a719351d7b1069179e7cd56d455d562745731d166175d0e8553d56e5d156cf2da66d916
-
Filesize
323KB
MD5fde101cdd7bc4a9901f0679e2df246d8
SHA1c0dbaba660e70f6b633d52a9c1bf019d3fd8b90c
SHA256260545747a9292a3c750d7f47f09ca862f0f150e8c41c1a43514455b61b4455a
SHA512d62b392233b2fdf16820a38580d8d27518b3d912ec3a883da81dee090f1e48d73f11f3276262175d715ad1081182256e6d00a3a8f7abb55f31c4351ba687af2a
-
Filesize
323KB
MD59eb50cdb838a7a3b1f6b42d1a35abe7c
SHA1dba5a4023fdd29093dd6e9a0ecf10f25a9093727
SHA256a95f565ba1ba60357a6b9a35930764b2b31581669d6c33d697c550db7af7c672
SHA5125f2f0157454b2dd803163d5d6fd90ed4f9b0dc92df019df14b48d257a14c3ba6abed0deec1a0c4495636108f8ad63735f7b276f5948263b5eadfc0aed502a616
-
Filesize
323KB
MD5800af4059c83abd04b5d0e9e8c500712
SHA11dc9a896ba622ab8e94d38621a95edee2ba665f3
SHA256638ca68309096f91d3e127dde08805934d1ecb6bce0adedeb4a52cfd5b8e8795
SHA512327393d586f804bb5aa85dd7f8167d485d39c9123be93225c6a6d87cc58be8ae5df0ad0c4a8b0d90aae90852d0e46837b55dbff2dcab4b6f0ed17b934fa5c525
-
Filesize
323KB
MD5b00d3e4c516ffe5b38294fa6155f9ed1
SHA1593e8bf38e9e4e4c4133bdb34711f0b931da0d07
SHA2566ecd33d0d96936cdae90943df8b56293a9fb0461a505fb7c98952bf58a38ca79
SHA51297855979576792b5a24ab976f8c292ff196ea190582935dcc8bec2154550c3f39460d636d1dce82d0545930049a0b52355bef7b69196a94e7f795f5bb6117152
-
Filesize
323KB
MD5b00d3e4c516ffe5b38294fa6155f9ed1
SHA1593e8bf38e9e4e4c4133bdb34711f0b931da0d07
SHA2566ecd33d0d96936cdae90943df8b56293a9fb0461a505fb7c98952bf58a38ca79
SHA51297855979576792b5a24ab976f8c292ff196ea190582935dcc8bec2154550c3f39460d636d1dce82d0545930049a0b52355bef7b69196a94e7f795f5bb6117152
-
Filesize
323KB
MD5b00d3e4c516ffe5b38294fa6155f9ed1
SHA1593e8bf38e9e4e4c4133bdb34711f0b931da0d07
SHA2566ecd33d0d96936cdae90943df8b56293a9fb0461a505fb7c98952bf58a38ca79
SHA51297855979576792b5a24ab976f8c292ff196ea190582935dcc8bec2154550c3f39460d636d1dce82d0545930049a0b52355bef7b69196a94e7f795f5bb6117152
-
Filesize
323KB
MD5106db36c2e1b0436813a9d8b4cc6b941
SHA19d3a4ddd198fdff47619ef858694d1e7ae882530
SHA256f7f29520e637ce81bc4f485c26d0e22e7f9768400e7a74410e29f88d95a88511
SHA512e6196ef2774b3762b008b08d52253b91c65621a600290755c22a873418bd212946040d2aa61ddebcbb68b68481e2fedc4eae9bc27bb5d2d10543e40a48cff109
-
Filesize
323KB
MD5b00d3e4c516ffe5b38294fa6155f9ed1
SHA1593e8bf38e9e4e4c4133bdb34711f0b931da0d07
SHA2566ecd33d0d96936cdae90943df8b56293a9fb0461a505fb7c98952bf58a38ca79
SHA51297855979576792b5a24ab976f8c292ff196ea190582935dcc8bec2154550c3f39460d636d1dce82d0545930049a0b52355bef7b69196a94e7f795f5bb6117152
-
Filesize
323KB
MD5800af4059c83abd04b5d0e9e8c500712
SHA11dc9a896ba622ab8e94d38621a95edee2ba665f3
SHA256638ca68309096f91d3e127dde08805934d1ecb6bce0adedeb4a52cfd5b8e8795
SHA512327393d586f804bb5aa85dd7f8167d485d39c9123be93225c6a6d87cc58be8ae5df0ad0c4a8b0d90aae90852d0e46837b55dbff2dcab4b6f0ed17b934fa5c525
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5c8230db760516fb3db01e7ce117a88ce
SHA181e77503444c50bb2f03bf49107c4baa39acd470
SHA2567e0b00fb0abda96b54d248b5758ee9880a7fa39f8c1a27377d5cbed8220ec519
SHA51268699c844dc7a828617332194f6a9eb88b07cd5ac6d39f72e3c1ae2d146561ea237b1c016bfe61fa8bc5d9842da2abe0c5161ec7c153c544bc030c2ae6010249
-
Filesize
323KB
MD5c8230db760516fb3db01e7ce117a88ce
SHA181e77503444c50bb2f03bf49107c4baa39acd470
SHA2567e0b00fb0abda96b54d248b5758ee9880a7fa39f8c1a27377d5cbed8220ec519
SHA51268699c844dc7a828617332194f6a9eb88b07cd5ac6d39f72e3c1ae2d146561ea237b1c016bfe61fa8bc5d9842da2abe0c5161ec7c153c544bc030c2ae6010249
-
Filesize
323KB
MD5c8230db760516fb3db01e7ce117a88ce
SHA181e77503444c50bb2f03bf49107c4baa39acd470
SHA2567e0b00fb0abda96b54d248b5758ee9880a7fa39f8c1a27377d5cbed8220ec519
SHA51268699c844dc7a828617332194f6a9eb88b07cd5ac6d39f72e3c1ae2d146561ea237b1c016bfe61fa8bc5d9842da2abe0c5161ec7c153c544bc030c2ae6010249
-
Filesize
323KB
MD596770f97d9e7ab77bbca0a6b98a64504
SHA1aaa0de6fc8c611c40e39757d1b3ff9bd3bceb336
SHA256db83a5da649435c91c0a72d079b9f2c1eb922144ba750468d79a5d722d7e9207
SHA51217330233509854843bb78aa14d9dc928ec68fbcba2f3571ed0c7a99dff6a32e9ea3907d869dec23936c887cd018692e2a749dffa8848a945ad9a18e0c3d2bf07
-
Filesize
323KB
MD5c8230db760516fb3db01e7ce117a88ce
SHA181e77503444c50bb2f03bf49107c4baa39acd470
SHA2567e0b00fb0abda96b54d248b5758ee9880a7fa39f8c1a27377d5cbed8220ec519
SHA51268699c844dc7a828617332194f6a9eb88b07cd5ac6d39f72e3c1ae2d146561ea237b1c016bfe61fa8bc5d9842da2abe0c5161ec7c153c544bc030c2ae6010249
-
Filesize
2KB
MD543be35d4fb3ebc6ca0970f05365440e3
SHA187bc28e5d9a6ab0c79a07118ca578726ce61b1bc
SHA2565a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5
SHA512b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5ac8547068a4d88f961622a7ac385592b
SHA1c60bdfbfa11cdba9030600cdbb5ba79b27fe3b9a
SHA256e27b44e131fc550c3697d67b0f9cf215130f3ed26b640d5ea93f38c1061d2073
SHA512320d2ec92c39829f73d9c0449299c221048b285d50e3d1dcbaaf93636af3ab997b59bfa49fc83004f65bf182b7b8b8edbec51defc9e77fdd8e15a9168780c6a5
-
Filesize
323KB
MD5fe46b8c5ba4d5514f83196f517a77ee9
SHA1e319ec11257d6e04a1a765f656eb7ddbc0864b8e
SHA2567af6a416e70cbf5acfa14ae7c177a4c66057b76191af2b981172947fef82a025
SHA51281224ac92571aebaa01cb9576b4038ec19c665bf73818ac9368d8770ac05d9661ab6c2f3ef5b2e2d36ef4c59a8d58fc55cce71ecb79b33150973e180e836db6a
-
Filesize
323KB
MD568dfac834eef62afc45d383b4cfb7262
SHA17d50db3c3e44d41bd2de488aa2886ea7a69e9920
SHA2560631120254d184e5041fb4adfce54d54140478eba28808c6df0514cc8a7523fa
SHA5125b32c63553ef66d4439da3354487a31a595db09d3b4de452db17400b44b0278d31b61fde2d81f1e906f5daf6d0f70a8d990eece4716c694e70e3b769d977f9f4
-
Filesize
3KB
MD58482935ff2fab6025b44b5a23c750480
SHA1d770c46d210c0fd302fa035a6054f5ac19f3bd13
SHA256dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c
SHA51200c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398
-
Filesize
2KB
MD562b7610403ea3ac4776df9eb93bf4ba4
SHA1b4a6cd17516f8fba679f15eda654928dc44dc502
SHA256b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29
SHA512fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657
-
Filesize
323KB
MD523b4e1823e7a68b5eacf19badc4a29b7
SHA1df3700bc6e2902c0bca4cc59c81ef17dcb6343ea
SHA25657d57a08e21d8246b8f58bed49a234a2bab5235176a5a85ec8ae5379860fe62a
SHA5126a32f51dc3ad7bee5b4c178661855d79fa874b7de6eda47f396f6541ba0f859e18fe194d58b7686fb1ae7b68cff4f7ff66e462007d87351abd6609861ac45d1d
-
Filesize
323KB
MD5f8b933b1fcbf0fb25d8550a9648e3219
SHA14c3ecb5414e6647535332f681bd0d6778ccd315d
SHA256eac695add4a45667aacb101f6ac10d60d2dad21291a0673974fd526aa28f6454
SHA5122b7e0323c92420712d80e03fc6783d83e5f5efc15dc79716c972ecdb616cf4e3719102b0dd38a696ae1c9bf3aa0332357bce7b42d243744c4f33317fb3e34657