6d268e1943de4e9206e54f14e59fa8553ac76b8a95130446569d1a3cb1a71d5e

Analysis

max time kernel
156s
max time network
180s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12644767577b43190c147eb528390c86.exe
Size

1.5MB
MD5

12644767577b43190c147eb528390c86
SHA1

088d7b371666ae85980b073abfc6b9d7bedc68a1
SHA256

6d268e1943de4e9206e54f14e59fa8553ac76b8a95130446569d1a3cb1a71d5e
SHA512

9c89623893c35965265e667e625842b4c09c5f72e20b09367751cccc84aa8134ff99e3e5278cbb1c5ff9f8ced1f9797df19503f918d8774fe6e8fb4869b91050
SSDEEP

3072:15yU9nkjkbumccSJ5l/LUkXTpkiOY0R3iLv:X

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-80879317"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-68651168"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-19659590"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-59862595"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95_o.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleToolbarInstaller_download_signed.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\edi.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntxconfig.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Restart.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpinst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UCCLSID.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apimonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VACFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iface.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin97.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sh.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Netscape.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alerter.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navsched.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swxcacls.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ewido.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GenericRenosFix.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxquar.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swsc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupvameeval.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
2684	winlogon.exe
1880	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2196	12644767577b43190c147eb528390c86.exe
2196	12644767577b43190c147eb528390c86.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1880-69-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-74-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-73-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-134-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-179-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-351-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-2752-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-2863-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1880-2866-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\75345415D454A5F4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\75345415D454A5F4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 1880	2684	winlogon.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://tey8ljgk7s35k12.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "146"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "307"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "225"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "140"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "12627"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://1f670xtogd97k50.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "12602"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000301766dc5945c124505c8673d9f20a20abdb37c0ff90536dc1de10323915305d000000000e8000000002000020000000fc1f2479fb224461bf0832f45e076b93acc049b113bda1205c850266072c7f6c2000000035c16b509c85745ce37089227af55b83ce1b181b1a1a38e0ae60cd0089a2e14340000000651f9b6b9a087a69448f077411dca888f8b51d7e2bf933296bf15e1550455e44aced561282d35e5939f550d654a925f9e87141349e363807dff80950a0024b5f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004b607628468a6e10cf30920f64614b74eac62f54c6e700fc0dba12a54a86fb0b000000000e8000000002000020000000b13da1de496331a19096f3ba975bcc643f711e8820210aa933cf7b9f4b81c5849000000031928844b1b9449ee086fefa188a20740835fc676f7c1bdf3fb8442861d0249f69fa5511b6d5835ac436069c0ed4f8448d76918a1529efaca22419feb991f6a5674ee8dbb1c77193810ca15eee71f35ca202cb4941c6fd16caebb107286a408b8055d0853e393c49ba59a8de1fb98afe4f20256165762ec03080138e70c2a5938704dd1cdf4cf91685234a418abb74d340000000d86dbc1627eaaa556b9086869517496822448cdff643792c2046a985b68986957bb59cebc36fef9b4e0dbd8fdae281fcbb9a2e51a7ba0e8ae7ea65c90622ee7c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1615"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{677EDD41-A88B-11EE-9005-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410264593"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1467"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://bw6ztnnozzcii1p.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "222"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1492"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://1z1021gqoyww32d.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://r00crc913xqw5is.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1880	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2196	12644767577b43190c147eb528390c86.exe
2684	winlogon.exe
1880	winlogon.exe
2960	iexplore.exe
2960	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2684	2196	12644767577b43190c147eb528390c86.exe	27
PID 2196 wrote to memory of 2684	2196	12644767577b43190c147eb528390c86.exe	27
PID 2196 wrote to memory of 2684	2196	12644767577b43190c147eb528390c86.exe	27
PID 2196 wrote to memory of 2684	2196	12644767577b43190c147eb528390c86.exe	27
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2684 wrote to memory of 1880	2684	winlogon.exe	32
PID 2960 wrote to memory of 1704	2960	iexplore.exe	35
PID 2960 wrote to memory of 1704	2960	iexplore.exe	35
PID 2960 wrote to memory of 1704	2960	iexplore.exe	35
PID 2960 wrote to memory of 1704	2960	iexplore.exe	35

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\12644767577b43190c147eb528390c86.exe
"C:\Users\Admin\AppData\Local\Temp\12644767577b43190c147eb528390c86.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1880

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e630cc8997d232c9da0a2f0ab317003

SHA1
7b6f5cec44b4be1a7317d9332ba48a2d87dc52f0

SHA256
ccee5d29fe996b2a21bbc1a39abc5737ce9bc9b85926d1e1d54fd5674678073e

SHA512
4a5df1883e6e832f4d5623aa4cdbc3b6a059aa7cba42443127659cfbb90fa9843a6db8d437dd73146c4116807f63d0c064cbd543032717e5e43af5221d95d82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed9df78ee3484df9bf0fd589fda7da68

SHA1
68bd09ef97393833f46b4a754005a424174a0d96

SHA256
2d477bb2ee8e2cfa0b521043da4982fb046d4ede5917673ce97d4e48e5285ac4

SHA512
c404e1c4d0f4680884ad211b3404b6a7364e4867cdd205ab8cc9a7110aa7a884d15e0adbcc33da2fa37e9aa25034ffe0d6f78a57b2c6becb8cff3fe19dac6bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdb417d71ed8847814ea037662e285cd

SHA1
1864c0da06dca12a0113be309b11048967dea368

SHA256
72271b5a9731c52ff21876580bb5cd1524aefe1f478bc4ec357ee7c07e10a454

SHA512
54535966f868b414248344b9218893eb7b1122f8c7317ba13085fff86b850e4019a7bf17b7fa2e254f6f3ccc71d612078d8dd8256872f5a57aa623c536d70ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4880266a0e8630ea1710a34e6a29f757

SHA1
be0fcc96aaaffd8811fee63a138e4faf7aa71df7

SHA256
eeb1ea6cf6828e3710beb3436fa4814d365bd262b0dd693b92b381055fa01e64

SHA512
80d82ae2cb29e7d427b6d0189271cca8675b8678748fdc9ae91a2a3a6e7265dea439d7ef736b53602bb2beb95d669fd5f66c3ac701a438694d7db9b624222d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b3f9e241444cedcd729194d1705633

SHA1
6073d16bae48b2350947de26ba13e4286222f7b3

SHA256
3665cb233717f14f54d26da75370783246d58153c70bbf97b6aad5b6598011e9

SHA512
e7ac831f7c7a4cc4c36c7c9f974d3af76bedb66dda810d57f51107e48107eff7cfa19fecd8da704b34352f173613f988817856c8c7f640ba1c111defef5cb447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05fa394a4b2ada7c59b4733df6568361

SHA1
e1aeb87d4d49a41d22a2a68e9eca73b3d38d46eb

SHA256
4478a74164f2d4632afd7a58a7eda1573d3f924111f4998808ce20f259299267

SHA512
622c30c3e05a86195eadaa86238fae34a39190563849305846442fc5178b8da85d4fe676d97bcb5a8d9dd110615415e744fd96b936d15d3339c8881e72e50682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5478b7220a05df03690b14babb8b1650

SHA1
510871e5dfb07a379be2138a6bfa9fe468ec8738

SHA256
cd117e11ca26ba0d8a59025299b9000cc9ffb84b9f936a63e599518a1f34ec0f

SHA512
d31843fbef0b35e415c2fe5aba25846aea72ac5d41aeb1f617173fc6d8c549a3ae36ffcc7300d57be86e72e7098a9a0f83251c6f4559a3893ecde2a938315742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd491e4a1ff6898f9c7a8b8b501400a8

SHA1
1a39c84ef870fc9338631f0b6abd8259a8edb259

SHA256
5a7e5990e307b28cf738fad0c52a2698b51f988af143b80795f71138e5ed8611

SHA512
f96584bbc303b67c78fc6b4dadf02a3ea5cc39479883f4e2132200ca161dbf09dec8fdfbdd29f0e51d24cbe8e94fa79ec2d96ed33cc7b46f960afd7b25f64792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84b606a3b0f7402da21ea8190fd00bf8

SHA1
897f2f0929ed5b2647fbe326d23580744eb6352f

SHA256
911cbdedf75dfa139743457ed113109e8fc529ed1fa5aa4b1d4adfee3a4b3994

SHA512
f08a7c4202bbba8a5f65c66895d375f7c38fcb5daf2bc8e07c8a0a576eeaf581e339b9aeeda511b11ac7b9dae98a72d125602a34428f76d2653521697600cf5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07400414ac11de413e2a30ffd2ee84b7

SHA1
f1ea58a3aabada1b8cc31e9bf1e0fce17f61eb30

SHA256
73519f8b1e05ccd131fcd649dc8297814a5dc734e07e0418b7154c1a56b4e238

SHA512
47d39cf79eb13fe159ab1cdf526196ed923b5c633de483f42fafd4de9b9d6dbeb5d5b6168d3c42ca44ca5ffa8a47a514028acd2f91e11049cfd43b1a7b8ca04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9289b476601007ccf77db6e915a5595f

SHA1
46d1ca9023df430e081b1c3287f880b6fc6cd8ef

SHA256
808001805bd307f2d8fe44ea1501ddafb84f4e9f783241181616cc8ff711913a

SHA512
1ed5e35f7e9e619016e7cc969212f55e76f4b783b7be4c07bb9dfbc5e6ac44ce5a3a31dd0c0e53c76ebd810f1564a678c6aa94499b3a656f3f393a9f52f5bb6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfc8e5dd1f88c8e468197f2a96f61678

SHA1
dc8e44934cf99aec7b44f2e4df53ebb29845329c

SHA256
56c7095e5c1474ac3d519ad91c5d16b8cfa616de227593ce36a81327e7c6870c

SHA512
a3dc94fff2d548f978422a6a0971c70e4b02bee52f48a9571af44c0153a780372c027502207acb8cd2376cdd375ef89033f3f52b0ff9fa9d43e9520911e1f03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14be6bcfa650ae81d7a656d1f5b4a72f

SHA1
16c8a141284891d49b970709aeb96d6fc6718b27

SHA256
eb1a486497a3bf490c2f540780d325975b0a317c17113234ca336dcd54665e41

SHA512
0839a339899d52af33509642879e109e8813a612c687e82d9a0aa8facd0a15447b20d3929e18b1193e5ea3b37c19c8fe80ba0849b2f5ed1aa36c1e38a6281d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f2a3c583b76c7b154aff1dabbc8b9e

SHA1
2a22665b08c0ce6f2d407cf94b92026e46b9bd32

SHA256
b5b2b17986b76f78ac062422ebc08678149f4a117db7c371776636a590c4968f

SHA512
6fe9ff884b1105031cc01f3068727b7f9312edb24e95862c76b4cbdfa2c975c6368c74003db1ace0ebd92d628d3e83c419b6a11c21640e53ab71dd7a419b3999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1fd1157cd9d682cef16fc327f2cf5af

SHA1
b4e735916599669b62408dfb68b7a11ae851f7e0

SHA256
63748229324ba80d6a8ee2d7902baf9c3d69518ff77ade1c60e7728497aef8a9

SHA512
478e4212e5c99a943bbfbc8c344c4a058333dcfda49a76dcdcb46176784fada3216c16b39615e5b3f7b61f1492b9c4063a3a50ba24a7aede2af71fbacf6ba3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d30b56e6a8922398833cb9240c8f6146

SHA1
2b234c03f6bbcfbd577990fbf86136a05505cc96

SHA256
0480be864efb9c52ff9c7be6edcd4426b74f66379c07bfa9af0e5ae3521b37db

SHA512
06928dea774b8def1045132d102931b5aabc1742b15d4f95a392f72e349ca9bbd2371d4c67cd297749a83a0a95a8dd352c05548039509f8586c813bbaa6cd317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5f19f18edfcb713bd1a039addcb272

SHA1
ab446300a4177e05d9aa48e686f79d7676ba417e

SHA256
39b0d9844315fe2ac927a6384dc1d00f88f9417d15f0db5f41540a81afa65548

SHA512
c69e9b098bcfe44c9e8edab64648c83acd371113a699c154f098cfc1e77d9413426699b7ec4b46d6a3e5164fb9e7b3628d25cac59c6ad712f68509d225c9ef62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ee63c18343637afc63b8f557d9a82c

SHA1
b226e2b4d6b093596183d5e88348e1e891d8cf03

SHA256
a8b46893b5eb4654bbbd3ab6f73a81d7d2bf4da03691e9dd560a9eaa12b04230

SHA512
5a1916f015bd343993610065a9aaa1648751d91c5956603467d1fb18b7324e5e575445c23b7cf11d81f5a84cf55f755ece61dc8ec5530c6c4f378aabcb2abc80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c962c92b8250dc5c4f85069d060540

SHA1
c0f3bcc38b11a446c635ab7434f30803b5ff33a0

SHA256
3a34ab52856cb227cb438c9e355b6d440069becb8c73d9e6ae28640a499e73ce

SHA512
2205ce72df6203d4d58482c282f21dcabcbe37215674358eca56dcb567f8ec8c135e87bfee8941f25b5eaeaa3bd0a6c9ed557d80c25a7e00945c7adc7d0e9544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97c8250d187c3ff0f841f23cfcf911c9

SHA1
d9ef98eda1fa23be583e40cd8a191b28896e59ad

SHA256
c5edb1470f611d9fc6fff6922a2d81dcf2e7902157d9db83a22d253b2fb4bdba

SHA512
555e8d220de723ab3af4ad4501b9233beb097abf1b9e5d4207d72330f9846454bd61300e63551d7d64cb3bf124347ab480bd2b9d8b5b1bbf791c3914a936ba3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6303d8464db9a9269aff6a6ac7597f1b

SHA1
6da26ffa048c04380c992ff6197d776615c0c471

SHA256
97512b431bfa39181a88f00bcec27f0b9bff706e92218a9a82ebcc7382853ad2

SHA512
77c85b121bbafe0d410576a94df111d523109a8cd62066b6dcc849a6105caf26f496a08196a35d61f86240cebb6d31047f3ef10068023935f2a4c94342acceea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d31349282392b174b433126a2c35f3f

SHA1
04a77a78bf78e21b939a52ce043aedff6a4669be

SHA256
c6b761513acf9c1045e516b90a5748698653ad13f4b703d9bb28f940ef6366b6

SHA512
a23005f6f12a9f2cd482245c6168d3c058b5897b1635d716bd85f9646a4f1fe60a9d2e898327e35a3afbddd83e3c8d21733bdbdb78f84ba1b68d524b5d0841f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e108cc208ba77291087f351734b43434

SHA1
a6a58e99f890600e4374b5eb9ebb46fa3ad54424

SHA256
4956e49b4bbac91542223d3d85ba59b2d030769bdb81ae2aa41410299c603093

SHA512
5a138d240c247aa1b1f71f393a051ca7d11ba83b2e2d1281281a2fb83abcbecbdfe1fbf464fc8e5ec4919289dd031703da228f0111edae625f7227f9a11198f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abeeeb0a04302db14c26c47abf0b9ca4

SHA1
53caa876ac436ffbe0d001983039089cf440aedd

SHA256
98d8722f202d31e49fee03ebda9e343b6252af4124891c87f724bf9bfe9e01b6

SHA512
a7afb5bc6c3ad706d3268d3ba76cf27011c1267bc633379660138f712b282060de0137c190711f48befade1341ecf3cf285749664a3193fc5788e50a38675fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ad51ee4a4375046d307a3d966a9001

SHA1
bca1c45c24a21185e818dbf27cde32fa73b8481a

SHA256
6ea8d34c07281039c8a86578875af91667864be44b96d41c847bc3f4dc452a45

SHA512
8b74b0937b51c109890d5687d22d269496cde5740da7d71b8ba754fa3dc31130ffce6d9683e6b37c0efa4a4660735c082333d7fb678e6037a3a7611f3ac3b98f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab020c5fc08a3f3ab561f72174bd2b0e

SHA1
30c9bc7fa245a5bf0e0c816ac8100f5e9e5aa575

SHA256
fdefe01cf8a28bcbc3b1cc6200172e6785dbe4bcc46d04f622993525daa478e2

SHA512
241c725753d1e63ce9584294944d7191c2e851d727f9283ce41d2d68c32cae172b350f94171d52710989ae05146de9b96d7b9cb31d8044bcf88448458ec37b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03accd2612904013914a36bb810c3f4a

SHA1
f41ee759ac74095a599349fa9a0c321c10b7989c

SHA256
24fc91504200dc0514ed9f25fbc3a4db50ad8fb6c765d5f1951c094de7eadf96

SHA512
0b7b9fc7b86e2cf4bc2b4cf6564e264e7548cd33d3aa97fce5000c62a78bf25b33a37ddec000f83b26bd98443367db984d3f83bed98aca0de41c80bd26dad1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8779a9f88e38b54ac4ab475b73ad1c8f

SHA1
d175b014782298404293dec904fd530d98efaba0

SHA256
8b74d3e69df3cdf30cd4e387b9f2f86e5da3d33f9553ef1a8ce897f6412f5680

SHA512
75d003a861332f0fed127d4d41be112e77fb76f3effc3166493093cd189251fc8b763411081e985e41f88351fa516257cd21868ad398e14a30ad2380d5879d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
916ba2d2e24650d05b0cf6fa39fd4a07

SHA1
b47d04d9cc7d73af572c501b1a99a29a4255bf42

SHA256
ece528b4c88ac612b774a6a7db5980946449af01655ebd22d36442202cdd6000

SHA512
55546acd64742ad023f31829dd9d873b8651713d80a5e05fcfa30995f1ecc53243784443931d86494db0cb8d1dfd7b9512802944b3447c8af7f5e1eb4ae87475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
162927ec18783646df690a185132832c

SHA1
a164de6d40cf04fb15434c0419f6e665f1a956b7

SHA256
b4b1f0f77aa53368bb532a1edd01d2db141a069c1914a368a658e8b6f927b0cd

SHA512
f2784f4fe4f5ac29b57297d6f395b183e7e7c8b9bbc39292ca95cacda52b186ed9aaf433a532b6563cc447260c5292418d0d3821198852f9043d2878ec369aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2035a0e964d82a3d73eb48f80b5ec2b2

SHA1
d289d3c52f3c5c9afd17384001a8ead583a878ce

SHA256
dc988fcde6b6dde0ddaf2d86ba93dbd14010943d0d92ed2e1444948cd7adb607

SHA512
04d721a6438613e23a1da7fac1555c796a7715aa240aad265fa3fbe94f427bf4df0fc813dd30156c64051c356a6028628efad8e6101eb0955653828c41051c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062e4284f5e42fd50090043ab19af45d

SHA1
a1845a78d1fcf6f1a344dabfd89e5204040e90a6

SHA256
ae6f098b59c193ae955c634b7e253cdd911affa4e6819f060c6246139071a29b

SHA512
d0933f11a18ae7eb0e770aaca3dce6af7beaf21d7c3e98c914728e44bca414331c808cf433b7148e85fb6ba694f43bef34a992c2299ef34f00cbe846b89aab0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d378a8bc1f32dc80ddf3dd0c4434fe04

SHA1
1bdaa11d9c84f3b0dcf1dcbb1a7f92e3ffaa225f

SHA256
09c9829c2fab0fd19918d9aea7ba3d29515e469f5d78c6f57fd72f5058220e35

SHA512
c26e7234fd982c6ef6835bf048f64d81687c04eced87eefdf9d261efc85028c281e8ed4358a7097db32a05467328df524ab7c642d6ad9347ed8615a743458687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9b874fded4d92381307ed34163ea3d

SHA1
6c78705f7c85bad2d431c9db548f16fbc15636c8

SHA256
757ec64d866b7db94a87f4463d6a86b8b798f356291388f45a958b14b4b589ec

SHA512
3760cdf87e6b58ee46f0612ea301f538700d8dd9b82ed19b11ac37e2272419c3ee0e2e0fca86fd8a02285516359e608f237c60ca34ec3120e11618aeedd1e944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b83108b0ce854823a01f0d332aa3e49b

SHA1
3edb4fc5176b68ffc518fcfe404246fe10f80cf8

SHA256
e2750f0b7cf0f0962c3463bff6a50013808eb7ab3c933992b7c57200c6c073ae

SHA512
054e91e8cad9b74b780777b5cc4462ea87cc8eed4b247dc069341c400d9b2e3ebb72f4efd302c6d2e52a51cdc0e402cea4d3c0c5c08f2b3bda71d863672ee019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8477e9d5bb2d186dece89bbb65098c7

SHA1
9c3e45e99340415154feb40f3a01d5e1210ddb1e

SHA256
69816a8b5ae2d59e0794c60113029fb0311fd40db112043bec275838d918b1ca

SHA512
e18bc71440b21d47431e57f846584fdc3dc8aad1255b5d2013018b5ffa3da0a1347d253e78f8cff137d099704a4e2bcbe18ed9ea640d61a38bc4c331339a6202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
bc9e9a3fda802f25aab4a5ea80605444

SHA1
c9357c1131301c893c99864fe5801bfba519909d

SHA256
4cba09d6cce3cccb337b77bfb3aaf390bbf34b911c108c13b458225cd881b4b2

SHA512
fc712fe15a39b43fae2e03cdd878ded0bd1cfd577245b7507b787e4c9fdff5a40eda7f7924ea7187273b60c0d9782bcb596cc3234a212c73e018f2f909f87ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\75ZOYITH\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\75ZOYITH\www.youtube[1].xml

Filesize
438B

MD5
68b5f2a5b52d571c2bd7e8203004ed4b

SHA1
0f8d784eea61db8abe7cd4a6c8680df76b6de441

SHA256
0bef2164b52c804971cb91c616d1e767541675dd0ab477872c7499a242eb4e42

SHA512
6fd0b49c356f894719156acc2162012cb6b633911e88105a2dc0adbe432bbd34c99df28a6a895c183ba965ec84666a38c8ae1a98252ca3b3a817c19864183c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\75ZOYITH\www.youtube[1].xml

Filesize
19KB

MD5
ab0ec03f1ade83270032c4d677bcb402

SHA1
621b0aa91c3e4a7492f9a24726150fd3e9274a76

SHA256
8988509585e74e0e3db140d681f634c0f0131add086f716587f5f646c9b4f721

SHA512
3bac52d20e083241aaded6fca050eb28dbae948a7d9199955517ce6336613aea74a58764ecab8eee5fe0589be8acfe8b8e9bc9ddab6e0fce2b011f8a23824654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\75ZOYITH\www.youtube[1].xml

Filesize
578B

MD5
94b94763b68a104960a7217127ccf72d

SHA1
edda0ab7889ec606578d03bd245c0efea459d1cd

SHA256
477f2b95d80011bc83252844a8c72bc9419abb40f2f0cd42ad6423ec8ce72796

SHA512
8e0fdd6cffd45945bf02a5bc1974cba9316b39055fd03a7b85937276f9bf9b83e0b5282e0a5e847c4a1d02600a784aa09c6d256e3d3c11c9faa7b1597b057e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\75ZOYITH\www.youtube[1].xml

Filesize
578B

MD5
dd07b7cd12f94de14177be2c186a04eb

SHA1
84653773596d4f8d1ed726423f89bdbd86306f54

SHA256
a0be00bcf57ef567f87dd40d50af81a5db4ecb1ed46cc3d333fa25ecdf43dcf4

SHA512
ed7854b2b766bdecc16f8fccc08d13c5e4c86d37300a01d70365a70b85bccbefcd9f4cddffe421f152bcd5cabf184eb9b586f9578850cfd9c5a9d9b7bd9b01cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAJVCBJI\domain_profile[1].htm

Filesize
41KB

MD5
e9b905a906b72c9e5dc445eac45f2bdf

SHA1
6e30dbdb1007d6dcc06bc69f673910f290c00df6

SHA256
85ee45c695afd00e4fddc86173f8fd25f1072560577b5f64bfa28168b3e623bc

SHA512
23ec38d0ee97b7e88add3503bf677fc1ec71a62b369e317bd900e1f6fbf590c1a9de412e16a397bd4a4fa6a57591a27d0527fc410cbfc09605ce54717603bf00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\browser-bar[1].png

Filesize
715B

MD5
226dcb8f6144bdaafdfbd8f2f354be64

SHA1
3785cc5b3bf52f8e398177b0ff1020b24aa86b8c

SHA256
8c873472f4925d5d47521db4d52532d2983e9cb1bde8b43143a6cc6db56c35db

SHA512
ed898b12c4895f7aceaab443c1071e6376db71b4dfdbd769f5f3be71d562438a18b5e5dc36dd7cc610926e380603a894b2e81df4302680c736a412bfd3360d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\cf-no-screenshot-error[1].png

Filesize
3KB

MD5
0d768cbc261841d3affc933b9ac3130e

SHA1
aff136a4c761e1df1ada7e5d9a6ed0ebea74a4b7

SHA256
1c53772285052e52bb7c12ad46a85a55747ed7bf66963fe1993fcef91ff5b0d0

SHA512
ce5b1bbb8cf6b0c3d1fa146d1700db2300abd6f2bdbe43ecaac6aebc911be6e1bcd2f8c6704a2cfa67bbb45598793ddec017e05c2c37ce387293aae08e7c342f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\cf.errors[1].css

Filesize
23KB

MD5
a1cedc21f16b5a97114857154fab35e9

SHA1
95e9890a15a4f7f94f7f19d2c297e4b07503c526

SHA256
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

SHA512
00e857331dce66901120b042a254e5af5135364f718da56110a4744f3e64f9b61ba0b877013af8398a0f865c7bde6ad2f87b3c9d2d828651806409cba57aa34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF71.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCFA3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
438KB

MD5
3777a5d38dde99fb38d770dd7f8cc3ad

SHA1
805fb1cb5b15e07f2b69d5900b5ec739e0cc6d66

SHA256
2549781717720f90caae5aba178f3bc65603d0f34fc4711118b48c2ffbfd5e9d

SHA512
d57ac6b429b571a147b57a47fe3b7249b1e722a1840da45c07b85fe6a81ff897bc0467afd7c8aa215c4dd31f7107e3175efba5f5e7e05d3305880387d1045e7a

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
45KB

MD5
6df7d081336340587c16f22b5387a0aa

SHA1
459c721569de942460f794c2d2e70acc75dd3987

SHA256
0cabd9172e0f417f29191a4a04daf2f124eafb1d3089a28ddbbf6408d1861870

SHA512
03b2b6b7e0592b6bf269b1e10c7849dc9562793b91af0b052e3634412ca0e57a7f1f0bd1c3721aab255ad225a95652927a02758ea2e7007e1128c278a8e6e9a4

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
93KB

MD5
be045f7982c6854b9c96d6528b103168

SHA1
ee112609d50cf44c1e4f9f83b73b1961f9b6ffd1

SHA256
b81ba584dc44299fe8ac3fc6484dd07810d74c5832f2de16c07640ce9b7a7fe6

SHA512
872937e5a616b069c302b9f6d16ff3ecda5c6c2684906bfafc45f3299d5f006b9feb6deae4dd6db3d916604a0e4e6564d47cf83fd2dd16f3aff8ce7c042a314e

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
240KB

MD5
6d1e102830ee9d95b0f9e0a99ef8b5c3

SHA1
fb8ddfc128710e3bfb002797314add115ccd1423

SHA256
d9c6758d21348470f4ef784436205d94a10d1e9ec10b60dca3a80b30f82891c7

SHA512
3912f25ede7c4234e514d4ccc8490aeb84cf9b5fc00a5c66950771630c026cfc11573ab13985bec197488cb762f363650226ff94c4db12c27fdfb6e7a4002368

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.3MB

MD5
92786669da3b95c685584da670690144

SHA1
10599a8070b953e489c0a15ce05cc215451ee10f

SHA256
a1706c506c4f5933a6fb27e1b781fc56a09abae152b5f0ba11f2eace8a9fd13d

SHA512
2a3dcc3bcb39b6c20c2f4a045d8103c3a49043259964269dc7f9d7641051d6e9ec930e6b25aa40442a10f536ca392dc1ae05d2287e2c1ef6cb3b644f6706651f

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
420KB

MD5
ac902b5dd139e4d3f9210e124895b577

SHA1
cfed13c1a7b0ac9f9ec2cd26a04fa03fd0198991

SHA256
d9a38f6cc4e16985f6ae095b98c7447ddf9e718092f570ffb4a1bc34b6c8cdf0

SHA512
53442ca3b9ee41eb6d62c7098553d5ab8ac02076a75325bfa53d89b48cecc9edd562328494dd630d1437b9182c45f4037d15594818927a39e8afef3461e866ce

Download Submit
memory/1880-2752-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-69-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-74-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-73-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-2863-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-2866-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-134-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-179-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1880-351-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2196-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download