6d268e1943de4e9206e54f14e59fa8553ac76b8a95130446569d1a3cb1a71d5e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12644767577b43190c147eb528390c86.exe
Size

1.5MB
MD5

12644767577b43190c147eb528390c86
SHA1

088d7b371666ae85980b073abfc6b9d7bedc68a1
SHA256

6d268e1943de4e9206e54f14e59fa8553ac76b8a95130446569d1a3cb1a71d5e
SHA512

9c89623893c35965265e667e625842b4c09c5f72e20b09367751cccc84aa8134ff99e3e5278cbb1c5ff9f8ced1f9797df19503f918d8774fe6e8fb4869b91050
SSDEEP

3072:15yU9nkjkbumccSJ5l/LUkXTpkiOY0R3iLv:X

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-58207016"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-4313826"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-18814438"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-72577010"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner3.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jed.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdetect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieCrypto.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netspyhunter-1.2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanpc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidserver.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccguide.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallSettings.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsys32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpro.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pev.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\borg2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmias.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecengine.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	12644767577b43190c147eb528390c86.exe

Executes dropped EXE 2 IoCs

pid	Process
4428	winlogon.exe
1572	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-21-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-22-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-18-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-55-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-116-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-326-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-557-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-719-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1572-1805-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B4E474B4657415A4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B4E474B4657415A4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4428 set thread context of 1572	4428	winlogon.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "32359"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://86d2tbt4s89l8o0.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "29753"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "44158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079576"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a8181a983cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2900"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "30951"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{430D99BC-A88B-11EE-9ECD-42E20219F0C2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "392860191"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "393954087"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "43037"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "32251"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de6221000000000200000000001066000000010000200000005b6c83547187d4d4dfd775e7562ffb8753b3857d6a754853b50ca9eaeba974d9000000000e80000000020000200000002236ab1710985fe2813dd10417fd65e960567f8196229b0d91e2f16395527fde20000000263433f84439f4059c3292e3fc40ca76ee287fc016e24978b763d787dba2473c40000000b0d9ead068ddc155df81a84a02267138cd38370bf4702ea8595fddac77e59b91516dc1a384b02ac04e875500671e4eaf7e124f645cf1c538e639e392acdbcf95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1574"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "32187"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05f282c983cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1574"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "16396"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "33481"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "33630"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "14537"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1580"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "32340"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DOMStorage\photos.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1517"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "15250"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "28361"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "31047"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de6221000000000200000000001066000000010000200000002b0605bb5a4820d77f5e59b55b49459e45c7b919b951fa39e624bcaa1ffdc3d8000000000e8000000002000020000000c16af89c0488b91c40cd7f328c27d70c8307791ccbf2019bbd09bde5416b963b20000000c7ce2aa01236e90414dbad00823b2f6050289c69928b5a940476d44823bcefcd40000000061de4e100390b7deeb407de8141edf3f06d4e39080c182a66e8e1bad1ee49c75929baa6d2f1e1615bb801aa743c275d8193e4adb494aed3652c6c7398000935	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "31041"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\photos.google.com\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2721"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "16283"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "32334"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "307"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1605"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2746"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "30926"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "44183"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0867e27983cda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2894"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "29747"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "44158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079576"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "393954087"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2754"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "16275"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://4c5317dw01p6hi1.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://a1o3qs8k8e36l3s.directorio-w.com"	winlogon.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{5A995201-D2CA-4FF5-A8EA-04561EB5088C}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{B1258A93-0784-4CF0-84D9-BAFC4E2EE1CD}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{9AF3462A-72FE-472C-9B53-51E5B29AE66A}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{5B530DFE-80CF-4464-9DE2-59E1C43B2733}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{4912E427-4ED8-4070-ACF7-50F56DEB3FF2}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{E4F75786-B5DA-4D7D-9F41-3015A95E4860}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{194D13CE-5EE7-420A-B401-918ED6AFD3B2}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{9D402EB6-A91D-4EF8-AF3A-470DA3B4DE6C}	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe
1572	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1572	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4648	12644767577b43190c147eb528390c86.exe
4428	winlogon.exe
1572	winlogon.exe
1512	iexplore.exe
1512	iexplore.exe
3928	IEXPLORE.EXE
3928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4428	4648	12644767577b43190c147eb528390c86.exe	93
PID 4648 wrote to memory of 4428	4648	12644767577b43190c147eb528390c86.exe	93
PID 4648 wrote to memory of 4428	4648	12644767577b43190c147eb528390c86.exe	93
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 4428 wrote to memory of 1572	4428	winlogon.exe	101
PID 1512 wrote to memory of 3928	1512	iexplore.exe	106
PID 1512 wrote to memory of 3928	1512	iexplore.exe	106
PID 1512 wrote to memory of 3928	1512	iexplore.exe	106

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\12644767577b43190c147eb528390c86.exe
"C:\Users\Admin\AppData\Local\Temp\12644767577b43190c147eb528390c86.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1572

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
44KB

MD5
b3ca91392250d99bf94c9a3654a19a87

SHA1
935cd4135872e8866fd8dc4122a6b4769e0086a7

SHA256
fc4e30ab750b51f7c0a8fc27e0a9f4db0af248547b40a444aeadba5918dd44e0

SHA512
840c436d2b49c1e49291e312b0e1ad9b876772d7d4fdbb7edfb351c390f1d0c0941d3103566abba35ca78a8b5de57d94b8c62797cb223175faeb359e4bce36a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
63KB

MD5
93a008f289ee866c82fa30ebfdf545b4

SHA1
f0d5ed33664d6d03781eb4f1cb1c7ad24c81708b

SHA256
92b459f5155bfbb0ba569d929bf8d2fd2e1f52c9106d7b65f90fc509f9fbc08e

SHA512
a2f43e1c561c03d91d9f1c18aff14e1a635907e384183f00b00baadb9261ae46393a80108a928e3a17d66c28ca9fa92a5a83281d2c3a876d4ca435f9a5e9d2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
46KB

MD5
9a8301fd5960f5fde27f356c8423f65d

SHA1
4e262185ac48144f42b5c77ba4a1ed5536477028

SHA256
96720a93dfcbddf2f05bdcc963fafb7e0a732158296ba6312a0b4e9ca9e92cbf

SHA512
a7141ed70c0ab65004f22c10f1c50c698e795db100f8174b889a08ed90a4377bb43516d8c61a588fbfa8bf25047c7c424dd0065b2eda82dc31afbf34803d5705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
64KB

MD5
c948f1cb39b09b6fdc2ed8f18f852b82

SHA1
0df720c8a3f0bcf7498dd1a6dc22d752725c2300

SHA256
874da1442ea44258eef81e34a745760a9c856e468485a24a318836a781f5738b

SHA512
91788e05a362c4a2a2162515974877e56f222329dd8982d5a1e47f21a0208cac4ca67400509d04ca0a462d7b32ea6d521215df9b09c96c73e13ed83ca8d75b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
48KB

MD5
80d2af2f35b890c1dbe0740d59e30670

SHA1
468df3a1ff5694f4badd0b16f21167739fee29e5

SHA256
57362ec06d68c6865c8b23208e20f995521d6a44e83ed81acc2b91ee21e97ba2

SHA512
1c9ab0f45992abf72e72e4bf7aafa5336cd754027430c4dd7f22d98bc70f75a96fd754f53df51de953c9424ab6ddc838add5c6b4c47a3cf62c7cc105df9cf7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
48KB

MD5
5932b0c32bfc11567068bf79e8521c27

SHA1
2a8bf28ca09f053a4713f764c222a3bc437a4b87

SHA256
e7646603df07678f58298fcc70abf9a3c7281ef33549142d94e0790f70f40a7f

SHA512
8ccf7a5af2d98cfcac8e14407cf2d74d8c05438dc5a4c764b613d36efcc928374159ceb8f3389303ac6528cb0473e610b343dfcd152961444c7c9f3186cf05ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
440B

MD5
b262db0f2b43dbc49996d2a20e452f75

SHA1
6bf43fa0235c0ba4b2441f26e7681fa2c511457f

SHA256
c903de6213effa73a07131536f51c8f69fb9ad281bb7742740a717bc37891cd7

SHA512
0413bdd443c5f5cb8892f46db0d2d3caf2422390e812339a9cd9b548c3dcd88ce88fbc01baaa6bef023be65973924f0304b5b5ec26489942998772c7f2d3f689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
49KB

MD5
3bf18572c082e2f229f4fd28b8f053d7

SHA1
f051de319d4a15a3323478e3e1491f742d19d5e8

SHA256
1d7017a72e995d840360b5a9600fca8a7fe7a52b5eb9bebd09864e2aab227b79

SHA512
b4fe4931daaca246d2eedf0ab30e9c99fdf315b6ce234b850bdc1de15b64199330de385c9a58de34e323870220f4dff2b08dcac8ad45970ce6ad53cd943d07a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
49KB

MD5
b5d0a4f7b515ce5c57d9c927789d74eb

SHA1
7eaff84abdb535808112678e61b96170527e8d69

SHA256
022306c5a8c0f94933868970aa7eac0e4a7502d427e188120ba02ab4f7692366

SHA512
990166d63c90a86884039212c2a2ef61946a9028b24c4dca9a3f63ddfa55c4d20b0056cf61f5ed65951a65f6b01a918137628fe26c30e954d0bb24007e8ca67e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
228B

MD5
1e05dd3d8e8aadfb4948434f57b49f8b

SHA1
38468e8a7dbd6232ac4a78d247394f632efe8f32

SHA256
cd667331e3fddc629e9a5f9d7ea409ad255ab5b0f3bff97dd910d1eb06866881

SHA512
49f9adae93f361a051f07d01719100d85e37378feac7cf04563e68ff0cf71d2a07ec7514defc31495e09f7a4892ab5e31b408d0cd5ca142cfc9751c4854f7f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
2KB

MD5
5350857ec72e8779e89faa846d9c8a33

SHA1
bdc27b0abe5723fe8f45dee84cff68f3e0dc41d9

SHA256
39976d023f757ef62758e8e20f9e79b17db76ee74e06df613f293b9c7be932ec

SHA512
c40eb5221478f829deb02e3c1ab364c14ef7c11e1c3da3a998596e4952f7ad5a538aa66132fb58a3868d1cbd02d1992b3703ef96e4d747c60f45781093953dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
575B

MD5
31da0c987d515dcc0ee2886ca1d67d9a

SHA1
1e7f4415e9d18d30f14414d980d30a0719abc873

SHA256
dc0d00592c192d41d01423fb947fd8fec3c203c79c6668d2eb273a6b5c2839ce

SHA512
2d70925543fbcb4e43efbae2db5b889a81b698a3d94e42e1cf5dff1d43fd1c6d82fcc7ee1666f5c0a2c47c08ca4810a10c87795eba014c4c01d36b13e3d6ede4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
2KB

MD5
f62ed7954c5f6b4806c010f0628bbe2f

SHA1
2ad691d32c2b4bfc7db87125ca9ac42618c9e3f5

SHA256
5db41eb7d09870c1b9544dc5652b22d66295f4e26a5604fbb26b45ff9d6f83fb

SHA512
4bf3a74353848c5d9a85f488f1285297e46996bbf76358602cba1dc15ea504eee1a7d442a6317cb25fb20bd15187f0ac7a8d13ce32a8cd34239933bf03465215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
22KB

MD5
a081d9bf4d13487fb8ca92ed08783b58

SHA1
8632632ed4f25bcff4df2706a143ec32b3e9759f

SHA256
bffd2f15a6b97b00940c1861e58e9332faf2b8a968c481c4d88368d0b578785d

SHA512
bc352d78765ee1ba8f58ed9f4550f40d7f067bc2fe2a8f33123a8dfc26191f4725b7486bf69b54fd72c2b474243b91c0a09ee0120b8435eab65ff10b61e0842b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
2KB

MD5
5a870955e1a3202b4d1353eefabb3394

SHA1
d28db58ad8110a44facc2d6af6747196bc578288

SHA256
1119da2b76253c080ef07ab78d1c7fde993fa1d47fcea6e2d4427314d5351bad

SHA512
dabab2bca227f1b0299524ae8e6028e2aa67ee2b886dae78486bbfdcbab4393e8a5d91186562a3a0e726f47fd70c9f4068aedc706fbc0a5be11ddf0336193e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
2KB

MD5
0a16a40a1fbabb7ad52eb0a9cba08cff

SHA1
beb8405e05fe8e01104d3625c96ed26d66542776

SHA256
48a72920849c4d99a41db91d9ef01940b2519a8c1a13aac690586b6ae881871e

SHA512
6ed3d4dd694fa2a019cd4296b4db765da09b2171dceb09d7baec234caa60e491ebe52facd75e903c1aeb4218b77ecc7fb80f63f45a31235d05d49fdaf05b8bcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
3KB

MD5
f2d6f24e524bfbe59f535676a2a7ace0

SHA1
2f0dcf36a5498227c0b18c741945bc02f2bd63cf

SHA256
6a07ccd55286a03cd75cec7a39c3b0db808c1412cf2281821887ec8a012ffc5d

SHA512
82ff3b6eaab3d35809b999969f4ef0b7b5e6af5461a576861dc5a858d2f9094c5fd276f3b3a8de30c788a63c77070482e25c1924dea96628eb16a0e7dd67b5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
2KB

MD5
ff52e2fe584ec70dbb01d5c0e7e4ca9c

SHA1
28a299fa6b21006586e390bd66c581820459822c

SHA256
4d3ebc4e23190a2ba5c1d81fe919f7e653f37071022c939f8a6b2608a7f63dfb

SHA512
722e8ff06facd522c707e6d97947bc6efd77ff074789ada69edc24321ec9a6c70040926e7e68e1195e884e8ecaacc7b908f683468c228bdc101472711b20a486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
4KB

MD5
6c4af4fbe34f0a7d6c6a364c810c937c

SHA1
3a417b009a20eb67cf3a537d1be2de569c4f48c7

SHA256
9e74d5c4324b4cf30125df05f869f167b4acd5b6fb254933f1824a826854f046

SHA512
143a026dba9a9b92e4bdd6b4c4b2fd04a51a99d6301f97b61912291951fb68eddd9606bc5c2bd6c2f78666b65187681e117ac73e41a1a456b7ace36fe1e874be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
4KB

MD5
662c0910373eeb5df4167b79aba076a6

SHA1
32acdb9072f7c35596c7dc5ac86527b2723fa66e

SHA256
5d613606659e57c9b6840b915c63b8612ba4686565d46de52810ef1763ae539d

SHA512
44b5e6ad89aaf9f6d4ef8ca70d0a9831a841acc6894c3c2163dd073aa301c03922388cb4347334ad7f4b7522d4a58bdd7c752ca33f3e888e895b3091d5d4a594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
21KB

MD5
daceed074c63882d0204df80ff4e3eaf

SHA1
88205933c54da6a6c51967dae1e836bdba964ac9

SHA256
e5cf9ca844c296ffe6c2dc3f676f6503c163cac5a077b4c7dd273da18883b6b0

SHA512
56b31a28bb0bd72bf010dc0b417c0bc958a1b1da0d02d217b47b985265025cdad1004a737952fc29efb8a1de62d45f3127a0e3a7e17d981c72c0c6802a70d809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
24KB

MD5
b423ce26280ab996cdf8b30813a896dc

SHA1
7ce2197dbb1d014e6cde4e84edbefbe4054e1c51

SHA256
0903cdac9e55915a7449763e4ebd9e173bac1e64c8b536a22eb2f26d8a932ac9

SHA512
092bcf95ecce4fb45a716825dfd58006ee5fcb52258f1ea7baa7bff2eca24d34f9616f042b610ee8df0dc6bac0a98349b8c281005331de0afe960418f428fbfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
24KB

MD5
89961a38f0394e00ed7540fe3df62ee0

SHA1
2f056e316d2ef935b7a60af7fcd0ff7e94dd546c

SHA256
815af4664f0e85a234c6fcc655f30d91709af8c1c1e2943de388cee39fabd721

SHA512
94315ed05530a5b3c3d4120a54867ddc9f9a1bdb3994bbbd2bf9b6412e123e1b526d1e0ce3718e44fd7266cc8b6c37b1b273ec7bb90751e76dd17426d8bac3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
42KB

MD5
df23e3a9adb342b567912dc2bae12917

SHA1
fbe9f807fcdaba0107b8ce9e9ec263e2d1a8493c

SHA256
b534a96169b34b10faeb5660faed8b425073bbdecc177d9e1ddcf5d1833a1036

SHA512
13320b8ebe0fea8cdf98eca576581d433091b648cba3e310b7f7e8fce3554bb05544764b3ab50e4de02a22a668658db94cd8bbcef5e7a7e8586997ad78dc6d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L3144232\www.youtube[1].xml

Filesize
44KB

MD5
c4f956ef330c39189852b77e1829c063

SHA1
95863b7b503a1b918371d17a3422cfa7cf873e9e

SHA256
d7372064ed68bcf000af352fad576c3f08222b9861ac9cb7d6f39797e9a03ba3

SHA512
147882ce5db12e81872b4b01c86a2a6b12c931140486e9c873327eb0d37ccf7fe344e8425cfdfd046b1d8226a88dd412dad19a11cc2487a7ddc72e3076e1212b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verEFDE.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\BVf7Z81_[1].json

Filesize
5KB

MD5
97251dedbfd112d65e103edc1ae5a7a7

SHA1
bc09e25832a266bd15f20b94684594adbf4793de

SHA256
e2f0ef97b6eca62245eaf2621087c243219c6c8fb00d82b272302aded86e64fc

SHA512
51be8f46544a3bedc804524cff7a83ce8837d61781ee21f5bfa5a10f4fdf6e389bd2776bb847601c0e862d39fbe8394168c22a61d4da232171fdd27045a2437a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\css[1].css

Filesize
530B

MD5
0a127ad39a8ebe4207492293b556adf6

SHA1
17d3dad64e4f9139cfb85bbcca6659a8aa532a48

SHA256
c1294965425b5028a83bbe5eeed0cd9b92733ec41efd07e34532522d4c97b6e1

SHA512
5aa845c5c6c20259d9c6bc0c9fdbd13ff178ba4008865f7113387767db0ad39cd53c1d276cfa4997186fd39f21d30bf00caf8d092e5c04119d992368b1563df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\hd-header-logo-v3[1].svg

Filesize
3KB

MD5
d4e44251f8e9314a0dec5eddd6b1c64e

SHA1
1c6a1a884585b80b3b623c92164b9d8742e5fc1b

SHA256
097a98eccd043b5df15a66409d32ef16f7570776625d0e0b4d1054be26a31a00

SHA512
1aa924657ab4043a27523e8cc1673314a037b063f8b6f530d5661917d30b893744d90223e5df38f2c97bf2ebb1e82ec21f91720dc27918ff853277ad5023612e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\main[1].js

Filesize
7KB

MD5
34872dec244f13fd4d9999bebc2a6311

SHA1
00d5a2abd9e7b8179dd7e78ebb8502ce6fe9466d

SHA256
e65f344cb3dbe8bb4e64fb8b9f20b0917f8b976c160b854d65c0d4ef38763bf6

SHA512
70a0277c3be9584efee6184338529a6c87a60005ac7946b2601d4febb0ed95dbd4ced12d96351d1a8955f2e2a1a45cab7951b75f06f18bdc014e78aab3695759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\script[2].js

Filesize
94KB

MD5
95e8ffa91ef91c1e68f9d647feebe119

SHA1
efbb044430afe01e2987f5f436ba0303c23e15c1

SHA256
693880fbbc65bb93b95798ce3559971dda0c635db8db33b3dd6d1d3d0414e6f5

SHA512
af3349e738142f141d4b6bea3aec0601dac3c3ceb40c38c6add87c1d7b0a54d4d9f9b4274e2e8215d81ba15803727a7751ba09295cbe86dbf1d42b9f0e61070d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\sddefault[1].jpg

Filesize
22KB

MD5
aa005bab01a96cc8ada465b145645867

SHA1
3f34e409c60819b76eb988076545b69d0c3d7273

SHA256
e80a2f33030dbe31f5f1e8be2c38e0ed8cf1b97c657dc08f16f48424a19f6fe9

SHA512
4d2e0103ca3472107fe20e797d916963df98a0e8ab3d30bcfaa97f231ad43daa58f8c6155884a4191bcd1d81a2654bf282aaffbcf72d3596f617cceb2a5ccaa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\www-player[1].css

Filesize
92KB

MD5
0a6dac60a157d415e28a46272f5fd512

SHA1
8e5cf7d316235f964bfbac0f6d93b4daad56acb8

SHA256
6c801be702f3c423eeb488f5b4dd6c9ab5c317942929e43ce148f3c266329cd5

SHA512
c4368a2c3085d8c273929f6ab2576e5f84dd4b90869e0cdda07e0f72ae2fcf79a3423bce15ba2bf8e190746bd44b99e3baf238db062558ce4c95eb56a7236d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
bafb105baeb22d965c70fe52ba6b49d9

SHA1
934014cc9bbe5883542be756b3146c05844b254f

SHA256
1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed

SHA512
85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\ad_status[1].js

Filesize
29B

MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\embed[1].js

Filesize
51KB

MD5
02e3aa6de0c0cecb0267cd83d6f64d51

SHA1
ab29481e145d32c7ff2a2e850a90e93ea9e2a60d

SHA256
234595572b74d58cd52917208142b3131ad7992126358ee0d917a40cd1240e83

SHA512
2e01c259120af23f10fab29d646879a9db5d1b8c4d8ed37b1c6cb0a49c19fbd7683e77f1749ac476fb44fe6f992c2403a3590a8d79ebf0dbaa3164f50c702660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\p[1].css

Filesize
5B

MD5
83d24d4b43cc7eef2b61e66c95f3d158

SHA1
f0cafc285ee23bb6c28c5166f305493c4331c84d

SHA256
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

SHA512
e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\zyw6mds[1].css

Filesize
1KB

MD5
4c2e266587bb622926747856f9bdb65d

SHA1
16999e0d2a01b96b70a0ef191461388c5047f1ed

SHA256
cfddcd1ab28963d8219ef42d0b455b1e062521bfe7b100d4c47e0b9dd0a79023

SHA512
c9526cd6537aa068b48641fd2dfb93843fc5f535faa4cd856d4d3427c8f1e97d79c969215a9291fd50a96597c43dba3c45a3fe2ad32c78677e38f93dbfc32ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\DV8riFx6jQ4gLK3NxCQ0wH6lqJRF3nkZMG7zsdp4UIQ[1].js

Filesize
52KB

MD5
48e936b2e9e018ddb1f5346ea193a9ec

SHA1
5db531370c082965d774fe01e42bf9bb5c3a4007

SHA256
0d5f2b885c7a8d0e202cadcdc42434c07ea5a89445de7919306ef3b1da785084

SHA512
a28ee781a28c842e1fddc863f1b0d1131fe5eb0aa9512a00260061a7a5f9d062d0b8a9be8312caa6ec08b069eb1c198b3d08292852db88f648ab580806daf4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\d[1]

Filesize
23KB

MD5
ef76c804c0bc0cb9a96e9b3200b50da5

SHA1
efadb4f24bc5ba2d66c9bf4d76ef71b1b0fde954

SHA256
30024e76936a08c73e918f80e327fff82ee1bd1a25f31f9fce88b4b4d546055d

SHA512
735b6470e4639e2d13d6b8247e948dbd6082650902a9441b439ceacc4dfce12cd6c9840ee4c4dcb8a8f1e22adb80968f63ace0c0051811a8d6d1afb2b3c68d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\jquery.fancybox.min[1].css

Filesize
12KB

MD5
a2d42584292f64c5827e8b67b1b38726

SHA1
1be9b79be02a1cfc5d96c4a5e0feb8f472babd95

SHA256
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

SHA512
1fd8eb6628a8a5476c2e983de00df7dc47ee9a0501a4ef4c75bc52b5d7884e8f8a10831a35f1cdbf0ca38c325bf8444f6914ba0e9c9194a6ef3d46ac348b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\unnamed[1].jpg

Filesize
1KB

MD5
9562333de0510b42f9cf9f316967d903

SHA1
cf044643a23946f7a1b63e4c5a506ac99a90a66c

SHA256
7c71aeb28c43250d69e9d02571ce233ed30791bb4e1a391eb8c70f84f8e36d08

SHA512
edb342fa84c8a27cb22554b97dd4b2567bd13d5f40f687139848de21f52116be301f75e695637dbda385f6dc979bdd901456f4b0c324ae83b105e4d34b3162c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\zzATZuW5[1].json

Filesize
1KB

MD5
22c967d69f0d5054cdf0c3725cb8b2cf

SHA1
5578de8e9b2adfedec93b3483096d6b39c400678

SHA256
de059be36fa3924307eead3cde43546467f695181804528945151ebe0e5a0c51

SHA512
d1cbc0ebb7a8e0c1337d4844fb717ff17f5e6d155b1c3e95c547e56d3c33de9470d0c2be99908d0adf2fff5e389f9742c8f445b76a5fe4f71a60f4626744bce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\ctf5Imnb[1].json

Filesize
30KB

MD5
e01f460a1d5d962ebe717dc4ec7c2745

SHA1
df8f8976fc6d2bdf05141898b9952460bb9dcce9

SHA256
b219c6ac7c27792732ca3d8cf6a1a99188823fbbee44a71d5b23b1f7fec3dc0b

SHA512
6403eecca4422cfc2b14f17688ff3ac1c1215f50627c6cc1e2d8c8972e8089991e9ab83474876d16e14de144934e2fa4e77d79138f9d29aed7a83aafe2079add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\domain_profile[1].htm

Filesize
41KB

MD5
6ad856b52ff8fb8579cee3ddf7dbdc5e

SHA1
a5e9320b75183b7f2759fa00022d218499cbee48

SHA256
1f48254df6c3fa71fa9904f6641d173bc5aab881bdbe12812346fa9941a63619

SHA512
95da655e4318532b981d2161d6b0a0c5ac78c32c876fef59f488b0c22c85404718ea8519793f74678f80945f1f4a13cba1610e633d33d186e7a6cbf7a7578cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\js[2].js

Filesize
95KB

MD5
cffad753c9b33c155d2647b0aa84e488

SHA1
bac9e670b1540cc3e4d9eba425792fdc87430a25

SHA256
294978cc9631a90843dd54c6d9f201f48f10b3fc65b4d94c1a872ce71161ee50

SHA512
40231f709b3df72c5b2d411a29deb159c5c8f83ac0557af194d66e3f529549d55cc9ecf729daba7e7d5ca3303694c108687c7375adc840b414ba51b78bf52125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
93KB

MD5
df25fe4a8d9c8a1b174bd03b4ff6c9dd

SHA1
67f7df81b3bc3777d563400da6728922c844566e

SHA256
4f16df6ad598fc8b823976d3481f1ec0d0c22c1b6b3ed7fa86397e9f37b9ada3

SHA512
4d227942114197fec15c2fa960f41f2404cf4a4334d4d8f57a4cfbfe3767d5e7a806abc37a6866dacf5602e4e854d2e51ae17ba448b62a9915dd47bccbce36b2

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
92KB

MD5
cc8ef243aeb78101f3e05220851c0a2e

SHA1
29aaedf6120b292b20472480434b54fb69b21cfb

SHA256
7ef74a796e8dbd199abb7dc1be9bb837a83a9f2d3bb33ea365f23d89104c8c82

SHA512
dcac107f4112373aeee9b76e233cd0b80d203d2face192802b47d532aee700f61cb71bd1e7988df6769105eb1368bb5568c4cb056d281bf189ced88b6ffd9e83

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
428KB

MD5
4051385e9a01e7206f2ef0f55a29d7c9

SHA1
82a2610d0d1417a14483bea37b93ceb45100ba08

SHA256
8e626c4c37250e3593487927025c24ac0426a0b015ec64271731184dadadd056

SHA512
c01bbce4ee325d0ed76697e9dac53dfdaeebe9b2aaba33aafca2be8399280a73faa7b19cecb4f2f0a81b476168eedabc5a14a25903c93239d5bfd737ca6f683d

Download Submit
memory/1572-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-22-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-21-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-557-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-116-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-719-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-326-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-1805-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4648-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download