48cad7de3bb1247a5fafff1d3a206c3ec11c37b51b125176e4c8de92308a232c

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f6c9ce864ca5a40348b4c128d10c964.exe
Size

208KB
MD5

0f6c9ce864ca5a40348b4c128d10c964
SHA1

64758445ad7f8b28a8f04dbd38e11cb57be4de57
SHA256

48cad7de3bb1247a5fafff1d3a206c3ec11c37b51b125176e4c8de92308a232c
SHA512

e6d7eecee4304bd7df5d52347ee001e19298846ec0f3af2a6f394c77a5368791f087b2897d06aea99fec97461638de3183a47b6248e6e0ed9516ea8d3daf4ad2
SSDEEP

3072:cOJopl0OAbGi6sW3hMKtiV8QwOKqTg63vkHnjwD:Cl0HNTeMVldrU63vEnU

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azonealarm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winroute.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apimonitor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccshtdwn.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csinject.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmoon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\offguard.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unzip.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfind.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naveng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpexec.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsys32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsysnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GenericRenosFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccmain.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\popscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamauto.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Diskmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nai_vs_stat.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Opera_964_int_Setup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alerter.exe	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
2772	winlogon.exe
2632	winlogon.exe
2592	winlogon.exe

Loads dropped DLL 3 IoCs

pid	Process
1752	0f6c9ce864ca5a40348b4c128d10c964.exe
1752	0f6c9ce864ca5a40348b4c128d10c964.exe
2772	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1752-2-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-4-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-5-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-7-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-8-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-10-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-11-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-9-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1752-24-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2592-93-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-96-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-98-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-97-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2632-101-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2632-102-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2592-104-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-166-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-174-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2772 set thread context of 2632	2772	winlogon.exe	30
PID 2632 set thread context of 2592	2632	winlogon.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Sound\Beep = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Sound	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 55 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://y7956pw998fpzcu.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000051a1f5e82087fe56aeb4852a5b5c2823de29a52e9860978f799ce802b67eddc000000000e8000000002000020000000ae887653b0a71df860d3c5d2c06e39ea5dd6106d02f6a7c98ca388bd1d0df585900000004cacd173b8429cf08be33ab6cd941d52d4ba179ece05acaa7de8993ea2ffc3b6755a103654ca071ddaa81e6f854223cb7bd035a722be8e66ac2aab33e4f8307290d0c3ee754d73d1b15ae68dfc0770a4d8bc023755974bc1b8e38cd922eb8bbed7fd1ac1089624da9eba2ee5b4e8b58d0369052e8b975532c72804e776daff198e8e34c96375ce138b0593d1d5f3000c40000000a7bd4e75343b9ebbb6c8844a1daaab8a192b720dd8a10b8a915883e74ba08428dd0f630b8d675e1c46417b6276ddda84540995f34e568dda81ff57117362201c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409625699"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://4a593092842coch.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://m57mq4qs848895m.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://2f56m61ih6v6so2.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8062bba9c836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://010a3tztp4fqlc2.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://16n6o5wp8y92ze2.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://b35921pp5ud8xuu.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://tqvta9jk35jbzs4.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000084a5b6a70ad2ac8954fe3074edee30e403b0bfc24758eec49503a1707ba125ab000000000e80000000020000200000001fff05f46e340da1d0354119693d7e8d852cfd6f508478ba5393ac620cb0afbc2000000000c2a5250726f2149748a6bbeb217dffddbb18bd30c29f70fd38ead37fd6baf2400000002a953ce867ac9b496a7c912007741c90560e942188741aa6ec9cf40ce1bdcaf6357f055f7870243659b80a1c4536f1bc2d71942643c43730f7e29a5dc233d10d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D20C46A1-A2BB-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://1400u7jrdtx39wi.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://rm9z2s02ys6ic9x.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2592	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2592	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1752	0f6c9ce864ca5a40348b4c128d10c964.exe
2632	winlogon.exe
2592	winlogon.exe
1792	iexplore.exe
1792	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 2612 wrote to memory of 1752	2612	0f6c9ce864ca5a40348b4c128d10c964.exe	28
PID 1752 wrote to memory of 2772	1752	0f6c9ce864ca5a40348b4c128d10c964.exe	29
PID 1752 wrote to memory of 2772	1752	0f6c9ce864ca5a40348b4c128d10c964.exe	29
PID 1752 wrote to memory of 2772	1752	0f6c9ce864ca5a40348b4c128d10c964.exe	29
PID 1752 wrote to memory of 2772	1752	0f6c9ce864ca5a40348b4c128d10c964.exe	29
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2772 wrote to memory of 2632	2772	winlogon.exe	30
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 2632 wrote to memory of 2592	2632	winlogon.exe	32
PID 1792 wrote to memory of 1908	1792	iexplore.exe	39
PID 1792 wrote to memory of 1908	1792	iexplore.exe	39
PID 1792 wrote to memory of 1908	1792	iexplore.exe	39
PID 1792 wrote to memory of 1908	1792	iexplore.exe	39

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\0f6c9ce864ca5a40348b4c128d10c964.exe
"C:\Users\Admin\AppData\Local\Temp\0f6c9ce864ca5a40348b4c128d10c964.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\0f6c9ce864ca5a40348b4c128d10c964.exe
  C:\Users\Admin\AppData\Local\Temp\0f6c9ce864ca5a40348b4c128d10c964.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\E696D64614\winlogon.exe
      C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Sets file execution options in registry
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2592

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0436f3294bb78e735149bc71a06b5029

SHA1
f8833b61107adca393b68abe7902cea3f8c1d050

SHA256
8ad6e4d57789c4a2818313ec45357de9f6ef17c0ea59f1fb12c9ea809791da88

SHA512
ca065808ef20f025438107756c3a8551d0a59ece1ebdf0477f36d57f99c62fccde7447071c11d6b077618829c4694d5bedcd2a892fccd1fce22c665b5cb73326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
110ee6c03969f7fe1d29daeb510fba65

SHA1
eb7f863818501a8322c75b7c539cc524e6750e6c

SHA256
dd4b19301a3466a3924b346c27471f6a2539d9c745a7a2a65ddacbe8f6df5240

SHA512
a4dd6e8e533cff580198e82d66f847aabbd87aacc3117be72c2b91b699e4a63b606d213900ec5be52582b8b5a8360ebcd6e5e21d3ef11e92c45a6cb0de52fc94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db6b12aff2db27dcad82047bf2a28892

SHA1
35c795a12e7c2674ef9a8f91f9441b9583de5c69

SHA256
c944ce3d28d798c057feccedb480246cf7bb8edc7c95352fcfef087cc14affa4

SHA512
e39c33b7b67d752f1dcddba416b698cff3ca83ea77556f906d9b6b6cb4c694badf1e1a2131506bab1f13044f97cf8d3c506f97c0e5cd8aefddf2b0970b6f6a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a09c52ffb561d11a0b772de0b6e09a0e

SHA1
de3742161986a16bf6680d4bbffd3a9992ca1b01

SHA256
e0db3dba068e55dd6dbd68ef982702fa1dae48d2811db952246a0bc1bfa19048

SHA512
b4cb7849cd4797c26bb7e865b51ea6ff791ad52d446f2e9ee71c6cefbfee1e620caec39236d6a67ea9d3b7eb9312c3794e0c505d0ccfe52ff307d5feba6577aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f40ffd6920ec83b55313368ac2df81

SHA1
e532cb33cb86574de50a3226ad108cce0cc9b204

SHA256
d05c9c085000f57136fa3c9ccccba602b2e445acd5580aa39bf1edf917bc12cc

SHA512
03f800efca7e478c0ccca991222747e6ce4f16c96bad6c428ac22327899974eb40d647a188946648a562637c96ce03adc035e1e22f5a59892650a1a82a728ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbb4b0a7bf1fff4c2460a4d102ea9015

SHA1
c192f7407185422bc4a90c70d355fb8b70feb9ca

SHA256
b6ad9c76f2025c36aa3afba5334eaa11bc1d1d6a3cda9c0b81feb77f9546faf7

SHA512
5494fa00cce422eefae949012708bed12652be224fbde2f0b3b202fdcd7f0d430b6445e5201d1a92e9df9aa235ea2c34805d9cd632200a566a14bc83262fbdbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50a2326f382cd24e55459b48119394f

SHA1
6dc908d7a01c894c826465d6bebc30945cb6f55b

SHA256
f8fd033b44175aae8c60cc1ed80a7a2e9f846199e735e57ca0cc11998a24c24b

SHA512
003de7480eba5190ed3f3911486611feeab54ad2d94882180e624f4a9e5bf9a895fb1d8e4d8d3110a8a6b0021c2f030974ad4f1f131c1020be74d2efafd7bdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514b79082b925e084293d288582dc8fc

SHA1
0bdc5b29b94f42293604ff1962b95f6b88d95a03

SHA256
b925c4a47d85e6aaf6ac6999346e7b49efb94021930cdc2f29fdfa7971a05cfe

SHA512
99003563015b59b5a2054b9f5cd967bba74f8047b73fad02c7de63849c43e70e4012019daebe22a7dd86b5ecdafb3499324a7191a5c8b1b3b68b9d12bcbb7616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80806cc543c458f35d8fa8f25929a2c9

SHA1
3e5643dba6b6cb7367847382d1f6c6a413bfe5fc

SHA256
a9312c1114896568fe5d91d459c1b92f0cceeeeb2670ce63ebf27ecdbfb93071

SHA512
c1f2006043d29b9c688600a014273d52842b62b254c686df479b713226213609006067acc65322a5bad21133b590354b89727b3b13f9643cc5977172be9d0949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ffe8d90ec27be42803a61c5c6e15da2

SHA1
354aae3e5f5bddb579e28e9e4bdb9a3db721c1d1

SHA256
8a0f66121a6b4989102aaea9c0899cae25537c928087828237051471a3af881d

SHA512
ed12b03f63284938b3c6729a73e4db80d6020bb264d89115a672c2856220d1036cd01b6af9b480556413f808eb4eee59af0b78c7074800ea08df2189126e2c98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba644404cf92629e90175c00566808f

SHA1
a2d3b32877b3cd031b26034742b59db6f1bfd182

SHA256
f11feebd925a3df33179f2e637f61175093409c3be5fce5b822a011225bf5f32

SHA512
c42808d9a5506c2205ac84d6fcf01dbfdffa4f6f460d12604bcaa31c98881f880aa627f87c7e4ca442f33432208ffdcf87a9faec6440ee5a5b766646b4e4bc13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01cd4e4a45573e552cf230717627853f

SHA1
5737cb2de486159ea9159e9e16ebca06b21695fb

SHA256
573980cf48ee414d8d3a633749ed02cc78ec480833ec4aa55878c4d393d8c560

SHA512
8d57436c9bd2c31b285cb27cdedbf92247871fcccce414b422cae85949717e0d8f5c4d5c21d17ad4ee16b27030c7190b42b5848e52ca4b17a82bb75fac3d0393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a1d3916f242910f8681d5d8ad975e5

SHA1
bc28df5f3461551ccbc61319ae2f8780f51acaa3

SHA256
0c26d0ccc3bbc2ccbcab047faf4a45f73f5e14f4ffdf5edcbefc21128182be07

SHA512
5b3111b5b0a78e37f367ee72832158eed79e2b139f63c31de21eb4020657721282906ccdd719d530cc91873726ce019e982c2251034f5cfbfa25f7473a2dc436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5e052bebf0ca751f5eefe82bea81775

SHA1
b9fcd50b6b18157f838c455945a3c39eb367e59d

SHA256
9450336b0e0fec52a813cc7361d3c572ec8275a2d344dbc624b902d90c0a3cf8

SHA512
7c93872ec07b57bf83850bd0515bd063f06e4ec3ffe307b488776a742f5a7884d9641d186f0e09d056ab00bdd6f5a127e661c242cbf5e7d3503f1930b94f48c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8f4183128070022f265e78e6fa2f2a4

SHA1
08128a3416d31c96e4ce7388107354c741b0069d

SHA256
a03039fb7ba379242b883d69534a4343b53893e73632364f717e4e598cec2995

SHA512
8d9d5455f92651653067728661c6430c218311944185f07e0b3a2dfecfb4d567d8f1bb822d796d60a451da2a015698cd94b1d03acb885a6d2f17209d9b617491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
208232a7e17a974641f98625142e9c3b

SHA1
fe5c0b922926423da92ebde8cba9cf5a3be38fc1

SHA256
044a03621648c431d473a22967e55d6c500d6818ea33ba8dcf2eacd0401c3c97

SHA512
440aa6b16f95964ee66b6b909424d133e031c15d2ea884d21e43c4d6d66ed5fcc320c9729d36c645b7a8f4a6cf0fa503797010988ac5a0faf286a1636e7b4f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d54fbbfb811c5b3e0c8e2f91619743

SHA1
c7c73c83cc6b64568250bbe24756882dab868e5d

SHA256
0cba121d10fcfccf2cac592cfb1287d838402162fa3691ad559fa4d0f0f104b2

SHA512
a904daa7551423b8472443e2686bc36e7d9f67b3dd7fec13aa410279dfa3d6561bcb6afa8dbfd7a1a5cfcb07896ac9a89b850e54348ee5f5acb2675b538be154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be5fdf12fcaa3161ce14f2ea718d8ff6

SHA1
b056418c4c835092ffb511a41e3f10d4a8311e34

SHA256
e5a42b1ba079903756214cbbc03dbf3d7ef4029cc1858de58ffab4313f1367c1

SHA512
0200cd3aa428129afd02a725d6df4e352c0fe0927e3297c1455f33901b1a4a5aaa0074748fa47d6e258a1f70dc8064826a31c65dc46e7b2c0388b28e1e77989e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b016e34476ef48d345a1e7c90003a52

SHA1
b3e8a204377bc1f5a0353932d41b6f6c94b490da

SHA256
70c621f8cc6b84ca584f26926b1ee7d6286d47c8e02db287bf943a23fb3f8ae0

SHA512
5182191b3d671a8db710ec00c9761c3c9812bed88c40fbdb51a29a2f0b70a62ad8290a25027795f3604281344ba2a27beb3a7d4b0c194f9be372ddf39f299021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
925838ce6addbc13aa733c166df837c6

SHA1
cc9c808c2d7c833f2c8846ca36f7b767acd0e78f

SHA256
39a6260c8cc0771d11969d3d5455e1e16144dbf36afc5bf83a99b3f2939bbcd0

SHA512
2ab83ac1837986569e2c66d83787a31a3f6c3963d3efb914b1ab6b5e024fbb60c30cd874340ea827432f981bff8076813b0ea8c29aaacb8a36d99a297331a0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
164cda6b72119df4e8e602c6b05198e3

SHA1
adc9a467c02bd9549a1bc22501644de38112bf55

SHA256
2108d21009919c136f18427f16c76bf270aaf7a841c0a508710be958e2d8e1bf

SHA512
fd6f686b36d9a1b87b57ad6c146115b3083ba95e98bb75bde73a11466deb22eb8a80b2af4e4649b3937e1e8e230d18defe73c8bc7ae9ab2d6f7d9b048d82e90e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e238fb19b0f5ef43d0bca7c9db582d

SHA1
880324c2efcd8e0a9582140e08cc522f535862bc

SHA256
61ba0276ad9a66ea58635bda9d5738c513fa25e21ccd7370f943591fd11f68a6

SHA512
7c00c3ee93238a63767aa82b6645dbd4d1b5b1f356de28161b294a13b8a2fbc0088722f5ffbf88204a9710e0ef57aa00c225436314942a1140f86df380c92a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11c0e2945740709c6cb53a905d61d994

SHA1
9838a5e9642cc6eabb4e2c1fa101ef19c8854617

SHA256
baadbe069024b4e1f634707c3c7806670aeff26fd75fa5b80b1abd6510be886f

SHA512
669868b223f8d5d3dfbbf609a89296048b65295b0d4df272b3c9be8596ef81caa2e308c26c42427d1834d11406b218f1424030088e8583557743bcbc5f152309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
591b92cb21d1e0a663597e804bd79f9a

SHA1
c6cdf898765e1a8f281b7f3da22c0809f5e01fbf

SHA256
141545f1643f767e2c294aa13e26e8ad184f0824004e4ed37cfc8dc039382c8a

SHA512
27619674007ed1f9b12b53a7010fafe8b952bf71d7b55063b53c6764ccaca91229a3238321f4c40515c1e8ded6cde50ad646999bca48d79c08ea4a54eda8a51a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf8ca8446d7bdfbba98dd3d295e95e5e

SHA1
67061ac95dc6bd2296a10b0cedcddbc1b6071639

SHA256
9a99fb869b2d5e18e30b09ffa63c2d77306379a0fa7148f637dc52d3de0812c9

SHA512
a52f11d5189a281a69acf8b682e69aab9a5100f71cfdf1d0037992d3ab2df7277888d2d63d849512c0de4ea9bde9667477922ca9ebce44dfeea5e1fb60cc8c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b18efe951facb65b19b3f2450d8e372

SHA1
6a2c420ced49f6b6092844383a2ae2ec770ada13

SHA256
33fd0e59eac659d498dcbbf33d09228053d8fce5893eea9ca1242ba369f35f56

SHA512
9842ecdbe8acccf043ae7ccdc866a55def2b95ece3873e3611d381d889c21768b609deb17d1813e638c24c77fa3b4f2b8b017d3ae424cf1f9751ef9ff5676a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ba3438e0f2a5df0a6a89996997acc2

SHA1
fd02ad1474577080ab43fc11efe63984c21e9dc5

SHA256
5627db9d31588991f857b92d986bb907b37af796d4e084ea8b6e1083cde4f32f

SHA512
61e832c03cdc77cc8bfe3bb298501b5cb16e7fe651078118840b0d60731514c44644781b87a8c57703498fc5983edb298610fc84bdb09023eb28d432f6a2460f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcab506b37cf3ec83c0925ae3f20c926

SHA1
bb72b5d96563371caeb36377530fec2da4d36c0b

SHA256
89edb660c1f836e99c375cbcad7f803d1f6e53befc0d6a1cc56835c59ac96734

SHA512
1781f30a0a7150b0b990c17b2939d23641fc803ff0fc66a65ef0247ab929d65d180c28d71540c9658358d142b7b99236544e709bbb0d061de9368d06e90fd631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eea097385d2eb66dd0ccb14160a953c

SHA1
fdf1bad59b37dd4b0a00f8c4f187b5d2c8d4c746

SHA256
db854f7a069ca95e1a8fcbb190fb3ea70403e3ec7a2028c1a0be4770a5116c5a

SHA512
5dc011798c3e22c01d8e656c604dac7a8d8f5013acbca8406a811dfbbb106cacb4313a40175a60d4efabaf8dc296f4ce1bb91bbb5268771e42fd8ea17321a045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fbe2b1dd402d45a0d35558332231972

SHA1
3dbbd3984ef1de0c89664651734a29a66a6ef0d5

SHA256
ece24b748dbe80bda5975096180120fbaf8c7d3949ff5b29644bcf8200732964

SHA512
2f6e77d85141b905b7851d2168ca0e9903a316f18a525a7b73fa07a75780838be081dc77463625f2e2b290602dd3d2710898be2d02db17ce66d35370e3887f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dcce232a331f01f0e365f53a967cf87

SHA1
7733f9e1004893503903765f94b65b0c53a6011f

SHA256
d5b1cce9046834f6c3efa1a386773b1597d8e9a888261801f3d21121877c680e

SHA512
595adb38f92ce5c8219761f6be1afeac933d0afa084f3d08be32f616598e16dc03e4b9b4cdbda1cece21e7c274145d351492517ffee87f3a0d4f66ad3d1dcaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b319d99692eb000fd68cf354a980ecb6

SHA1
c6a609160f71fc5b936092a2fa1ae5af6dab3098

SHA256
996925cd23f75928b6186c361e7df946562eff7e14dc7ac6f840b1e5d7c5e529

SHA512
1c6e96574cd785728dbb1993a337e4f210ba77c73ac52f9da909e1dcd9dfeaf7bfb6d3c6268c800250c1fe8d2f8ec1caea346198f7699a2a09a3a8f36440368b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9721ce0e062141ce14bd246bad8b91a7

SHA1
e1f3b1b71b145560509e50e9987345d50f6bc99a

SHA256
af55e55fbf2b738108927451a19624f9a567fa0624059333bc740ab9c64ae7fd

SHA512
c99b70e6ea7a66300fa5dea4e17863ad33b954cd48fbb3c91916de30a9eb68766782ac3a50e0922d5e70de771f4743d89a0053430201538fad656d594ad8bf7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
726e423e91a1144161a30a6179e036e0

SHA1
0538c6c01751a9f54643043b2b5699483e321fbe

SHA256
feaf2a7d12abdc60ac6a25d81c22d52cb1783794a1f4ccd352c25d1d928ba8da

SHA512
c3ea19570b83428790330bcf0064800b26c666f8dd66b113f843b1b6fb1760debf0a2afd9c42495694414c9cc39b00430328199680b3cb1890218b0e941c8758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a17eb5add281c161df73d7ad57812054

SHA1
e45eb2a2116afcb20c645ba28c2befaecaa13668

SHA256
aefa475716b5f6fe03716cb1198b0ca55f764e6bb146fbe0f53fb3c14f4a3590

SHA512
5af770ae41d821b3dc46ca26faf580713fee64a3d1e6f76244002e2c18fcfa92b1d00871c4cad5cc45715b9b0f9df5c4f2f1c0f2fb50d06eca620f17a09b5413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5109473ec318a48b8af0e7d955f3b52

SHA1
0d56f2273c487f71590529603938ef8e98fec37f

SHA256
df4f0c03d161ca918b93a520a1497f4360c86bc0a0daaf73381ec7340fa1fc6c

SHA512
3a2493fbd268e04a57ca14ab56f71b857b1a824085f86ba90170d4b4242e73c9c0fedb039ccdab46f201ca4bc4a7cd5e15fd2fc338a5514787b8122adb30fd0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a67dd262563b02ba077271f0d1671b

SHA1
02c61664c1b5486ca31c5acda056c448b78195ab

SHA256
b577760b7714f6673f6e0c7b127f53493eed6db20de66c797daf1fde6ea5b205

SHA512
b8bc7aeb243676914d916935b42c6baa68cef00405db5b0c2a4f383de6045ac77318a17af6d359f3459e90c7659fdf42864cb970576bd59b3c7ef43a6a9154d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
988ac614ac4b1af534d707942c463e0b

SHA1
40c837a7a4e5adef7996ed5df535c89a367933a6

SHA256
5f2ba78864cad4cd89b2cca827a66ae247f7f84b5bdf4db4d55d22332995905f

SHA512
6d41bb24b8a29cd0fa603ea4ec350c5e1983c247f738839069d00518680448f30253a506aff6a1cccbe36221af352cbfc87dd470969aa6977e08172f9e1ff75f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12e0faa70d089767b55f0268b760947c

SHA1
2fdcb4e7b073fbf7c2df919cea5042ad9180ede2

SHA256
d51ac5cfc7521d6157bfcdaf271aa78ab25d04b70535e808583f9eef9352913c

SHA512
88323c85dfd3541e44c1b53567d193609449d835c2e6682b77e3f56c3ffc95f7737abec1244c027428611e9bc396038c0dac3e17e1c86ad0225cad707a14a63a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
886d50ef9c7fd66c3ee4a24374afb39d

SHA1
404b464926d908b1f0820ce8f993f68c65f11131

SHA256
2a80cbafd2321bb2b9e9097bad0e97cbe03fa8799fe011ba050d6e74e50e74d1

SHA512
74887ba0cd703cd831c4b71343add7ed6db79077c1301900119081d59782436e50c7992b20d42bd6bfe3d64bb6ef41ed134d9841ba735e6465692af53966fdb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6WEH2YLI\cf.errors[1].css

Filesize
23KB

MD5
a1cedc21f16b5a97114857154fab35e9

SHA1
95e9890a15a4f7f94f7f19d2c297e4b07503c526

SHA256
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

SHA512
00e857331dce66901120b042a254e5af5135364f718da56110a4744f3e64f9b61ba0b877013af8398a0f865c7bde6ad2f87b3c9d2d828651806409cba57aa34e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6WEH2YLI\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\styles__ltr[1].css

Filesize
55KB

MD5
eb4bc511f79f7a1573b45f5775b3a99b

SHA1
d910fb51ad7316aa54f055079374574698e74b35

SHA256
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

SHA512
ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BC0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BF2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
208KB

MD5
0f6c9ce864ca5a40348b4c128d10c964

SHA1
64758445ad7f8b28a8f04dbd38e11cb57be4de57

SHA256
48cad7de3bb1247a5fafff1d3a206c3ec11c37b51b125176e4c8de92308a232c

SHA512
e6d7eecee4304bd7df5d52347ee001e19298846ec0f3af2a6f394c77a5368791f087b2897d06aea99fec97461638de3183a47b6248e6e0ed9516ea8d3daf4ad2

Download Submit
memory/1752-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-24-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2592-104-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-166-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-98-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-97-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-93-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-174-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-96-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2632-102-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2632-101-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download