35d39adc1de38ea66a93f9fe23a1fa2b784b61bb00c7666c8562268c6a91f451

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48f7a6597b661bb0d3382a3aa2c84d00.exe
Size

216KB
MD5

48f7a6597b661bb0d3382a3aa2c84d00
SHA1

3d635ef974ad3bb4d94daab6e875b59bbfa37320
SHA256

35d39adc1de38ea66a93f9fe23a1fa2b784b61bb00c7666c8562268c6a91f451
SHA512

ce394adcc2aa08e886bc88b02d32861eeb9160c7874bbfb5f96f52f4567d593fde25eb22a84740677ad34b6fcd3d6004c9cfc1254ac2066ced3361a8a70abe9b
SSDEEP

3072:TfTflRNjzPF5OncVbrCVru0K67rMjb+2:LTfbz5W6bEu0LMjb+2

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bd_professional.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wingate.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winroute.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95_o.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\licmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\norton_internet_secu_3.0_407.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swnetsup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atguard.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zauinst.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95ct.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamauto.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootwarn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swreg.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedapp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
2668	winlogon.exe
2988	winlogon.exe
2028	winlogon.exe

Loads dropped DLL 3 IoCs

pid	Process
2324	48f7a6597b661bb0d3382a3aa2c84d00.exe
2324	48f7a6597b661bb0d3382a3aa2c84d00.exe
2668	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2324-2-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2324-4-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2324-8-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2324-11-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2324-13-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2324-12-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2324-25-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2028-46-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-49-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-50-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2988-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2028-61-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-64-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-280-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-664-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-856-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2028-2118-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2668 set thread context of 2988	2668	winlogon.exe	31
PID 2988 set thread context of 2028	2988	winlogon.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3168E0C1-AD5E-11EE-B494-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://v070f0d2fu0h1e2.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://l25u421y3o592ak.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://513t89p2c1xh2or.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c890fe30e7b1762bd600247f404216326ff02c0445770ebc37b190c743b44cd0000000000e800000000200002000000029871c9a4300504bbb07bfbbd196746314f57723240471dc015c3af428182526900000009c303c342da734745d28aa5f5dc0bbd9cf5f47b505d9fbb32f5f3f185a26ed1e17455f175429cd3cc9754347d83fbfd21efdb0f6936ae6756dd9ec648134dd2f93e3f36a766a2413ea0197e17616e1337218d711816163b218624464995e6ecec259578eabb4428337eb84062f49416675378f347fb65e7fcd595a1375e184fa713f6cf57895f764bd2f1f2702bb5a8540000000decde4b6e54a75cea7ce6ecd9525ce80e999acb887d5072966a995a60fcabf542ac06f73b075d2076d12f32df3620ad421b522446aa05623de324dbf31c1c5a7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410794962"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://1t713bb784p5536.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000002042df88b55ee3f7ed002e5d140b446d538870b45a4222cc028184b3d701663000000000e800000000200002000000082ca82f5b84fc182409c874e282017aeaed9b734bbd7c8994d16dc093fa86ed2200000008aed0022ecf8901313f97731d2799a9d316e94ea5cd154c02ffe1b4a0c5a896640000000b4bc9a73c8c7a95832ef545e4a74c36c0e8bb2309908f8784d1b6f972d15a00d58caa46b45de0394a5eeaf2ac0ae4fadcedada5db4cd5c0633aebac4c8cf3b13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505463066b41da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://1n24535ue25sn0s.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://667p6ap3yhngl06.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://7sq5nxz45gbfsev.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://h5ydt3i22q6s4i5.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://h701g42c10t4r94.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://h7po98sz328fw2k.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2028	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2028	winlogon.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
364	iexplore.exe
364	iexplore.exe
364	iexplore.exe
364	iexplore.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
2324	48f7a6597b661bb0d3382a3aa2c84d00.exe
2988	winlogon.exe
2028	winlogon.exe
364	iexplore.exe
364	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
364	iexplore.exe
364	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
364	iexplore.exe
364	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
364	iexplore.exe
364	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2028	winlogon.exe
2028	winlogon.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2420	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	28
PID 2412 wrote to memory of 2420	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	28
PID 2412 wrote to memory of 2420	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	28
PID 2412 wrote to memory of 2420	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	28
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2412 wrote to memory of 2324	2412	48f7a6597b661bb0d3382a3aa2c84d00.exe	29
PID 2324 wrote to memory of 2668	2324	48f7a6597b661bb0d3382a3aa2c84d00.exe	30
PID 2324 wrote to memory of 2668	2324	48f7a6597b661bb0d3382a3aa2c84d00.exe	30
PID 2324 wrote to memory of 2668	2324	48f7a6597b661bb0d3382a3aa2c84d00.exe	30
PID 2324 wrote to memory of 2668	2324	48f7a6597b661bb0d3382a3aa2c84d00.exe	30
PID 2668 wrote to memory of 2808	2668	winlogon.exe	32
PID 2668 wrote to memory of 2808	2668	winlogon.exe	32
PID 2668 wrote to memory of 2808	2668	winlogon.exe	32
PID 2668 wrote to memory of 2808	2668	winlogon.exe	32
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2668 wrote to memory of 2988	2668	winlogon.exe	31
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 2988 wrote to memory of 2028	2988	winlogon.exe	34
PID 364 wrote to memory of 1624	364	iexplore.exe	38
PID 364 wrote to memory of 1624	364	iexplore.exe	38
PID 364 wrote to memory of 1624	364	iexplore.exe	38
PID 364 wrote to memory of 1624	364	iexplore.exe	38
PID 364 wrote to memory of 2084	364	iexplore.exe	41
PID 364 wrote to memory of 2084	364	iexplore.exe	41
PID 364 wrote to memory of 2084	364	iexplore.exe	41
PID 364 wrote to memory of 2084	364	iexplore.exe	41
PID 364 wrote to memory of 1960	364	iexplore.exe	46
PID 364 wrote to memory of 1960	364	iexplore.exe	46
PID 364 wrote to memory of 1960	364	iexplore.exe	46
PID 364 wrote to memory of 1960	364	iexplore.exe	46
PID 364 wrote to memory of 1716	364	iexplore.exe	48
PID 364 wrote to memory of 1716	364	iexplore.exe	48
PID 364 wrote to memory of 1716	364	iexplore.exe	48
PID 364 wrote to memory of 1716	364	iexplore.exe	48

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\48f7a6597b661bb0d3382a3aa2c84d00.exe
"C:\Users\Admin\AppData\Local\Temp\48f7a6597b661bb0d3382a3aa2c84d00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\48f7a6597b661bb0d3382a3aa2c84d00.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Sets file execution options in registry
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2028
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      4⤵
      PID:2808

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:603147 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:1324041 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:865308 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16a3df395e7b7844dcb732c7528109f4

SHA1
8f51ddedc9cc2ea1114d8393a0a58886d54b5703

SHA256
5443f34d4bf6866c07bc82a2860e89a76ed7023082622cb6ac9b570ba3bd767b

SHA512
77a60e2bcec7a80e23b26bae9d216c9421230418652ad3616b71f6b3086bf0fb49bbae157804acac9829f6b9d3780fb42b30d773f312e9d8d1f9d1ae9a2f3c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6d8ed8a8d077892a12dd9b0e2becc1

SHA1
bd246342e7dcdc38de8e4c5bf21ce5f55882fa8d

SHA256
5fed69f66703dc60efabe780159f3129459c55eb816d0d40affde4b965f8df30

SHA512
6540a03d2d7c330f94f4256ad7128d9e1e2222ec822c61e0e00ece22dd307875a5fc824d80504ef057b291b95d864654f10e635d43b7c5d66cb30ba47eada579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbafc0d7a0e572c5afa551326ea0df76

SHA1
22b0d28ff3b41e6fab0e2353eda5d94e9c48c12b

SHA256
dbc32a9806faa68d983234ae4df2c9a4c9e21b48d2bd537a16bc872291a0cd99

SHA512
4817457fea5928cf4fc64b6221980031d27d0c24b26a83ba4a63f480cec4e78161e38aad01e503abd657624a6f2a35bb27994eabfc5cb08f7e2f24187b01ef1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555a806f859df021930d54458a8b105c

SHA1
7064443107bd1fa2dd4dfe951383f73293602b6d

SHA256
d49468922e66fce8bfc14706f23717eab708984af5e64fe6bd9f86d25ed79ae4

SHA512
64a92602caab77e2460fc6ed00b4d3dd279f1667d943d0ece85bb03e97d2f3e0fe028f6f4e95e0809eeb72dc9ae71a077a00f695130468a193b27fe9f4cf6879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9410162bbae650823033d339744e9bba

SHA1
c9d0f766220447b1dc1398a3aae8ce18b7e9833d

SHA256
b9ee9047fdf27460e4d0040e70b4fdbfb63fc9a0a256a699b53577ee102a95ef

SHA512
7f03ffaea88ed1505bb15eba8734993e72edfd69dac5d2547a2b1b7975712f49bb0d7f03bf7f3aa4797f91f1fa81a7af4f9cb0cb378e22369dc303e5d0aab321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10bf19f0287a77da1d6a5c76dd356b70

SHA1
c4e77622091004955828ab20b682f783cd09d066

SHA256
e5d2adffbd0ab897c303fe00949bbdfa32bb7f13860ce441b33e101b7a75dcf6

SHA512
f85a1877a501e7c31f491833ed988c22d501fbcbf4491ab6b37ad66dc2e92cdde558028becc65cbb737dba7f10723c837732dabce2d0b63f22a2b47ff59327f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a812c1f4d4a4120f2b82b97998cdc2a

SHA1
530d039bd9c2b96f5aa7ee10ec4faa5a15cb1454

SHA256
afe40025c5619a2629f6b0bb982ca4162f8deb86a906ff44e6cd24d4130a19e8

SHA512
29b391b2c34856e183d17a19b50d20dd44e7ce065bf798197a47764682b7f4115dd800f796947abbc7fded22dce425a0e9c6a6481da6c69ba20c0ae38e393595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
becebe0601da173f549b0e789ce330e2

SHA1
224cd178d6db7825468d3ae002d1b80cfab2fadf

SHA256
6077f501576e2dee901a35ad96197e3a506e6b05c47db38d825e884ab98a9363

SHA512
2c4b5d930e8a26d07f607409981a93a99f6211c587821e6e3ad2c811cc8ddd5d5a46c55c7c82b556efb5c03a1e164c8df64dfd6191cb3dbb8a6695bd991798ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8fcafa7c677b5d72589b41543f74207

SHA1
b334de8639489cc87777df829533885cf30bb556

SHA256
997f06c980bb48ed96d690598de840dc954be9e15d0b9da2b0ed754fefc46ce9

SHA512
82abfc9a7bb0e09aa82fde4b207691b7e28e23d3de935320c82b3fa9b0e5988629228ca3fb124e6bbe44bda78c27639d27ee514aee460e3e921e2ecf60089aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90b59a80844d3e4fc7781532928845e

SHA1
e3fe05a6589c0daa8a22ef0a966416b66ce1625f

SHA256
a009a07dcbe57e74d17b9b7e35d9a1ba616bb10c9d97764c0d49e8a8e6fab4d1

SHA512
cbbc2da100151c6a45213c2bed4aa613163a7c1064b5c1097404c039cf51eee5513f85cfca26f2232354839abdfb64b2ab6a613f78b613c69040ea766059dd3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0cb293946532f083df1a1e73ddaf83

SHA1
915449c3e8aa6b285f0bb1973fe87a66144978eb

SHA256
465749f1befb8952c99505d7819a19ff2cb02cfdf757985ab11753935880add5

SHA512
e75fa14dd7bf06d2be9777a3599bdc49cf9d3c0cc4778ea9e268cf57a1ca1566dc7e4bbf7fe077fc953419cf978f79a5854ed8d77028f585657791204b4b26cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d64f07aef168d96a76a9a6a5156ab74

SHA1
618796c0543ab079da39fe842edfd9018fbcd9cb

SHA256
ce31a0dffdfacbc937c72fd1d59c73d944ce3c093539c3a0136db402535af0bb

SHA512
69be9252cdb5f38147609c7e3d50c26cac811893adaaffe0eae3cc1630131396497e752154ab6c6d35f1fb0add0833742a022d75f6b27f0e07fea1d231af0d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5c7bb3084bb462b418a0cbf27b0946

SHA1
2e02f6a409e9f7f44e0092882cd57b363d6481b8

SHA256
2d58de69dbde836a1bb113c26a142088c7cbe1435cc716d0dcb1d152859ae259

SHA512
aa569724f9c2585ea0a9cee18d803c936f59267edf09c5c488658542d694016df67067c7985dbb87c3fdba8b121630eb812ada20a694b65043c6bace82073573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a820eb5a13900e1b9382794974ce3bd

SHA1
9269c4a7492b9924f1fb8599c2e070c10b1e3589

SHA256
46cf70b0b956f50a0a37dcdb93ef398a2dc86c2180a2043b1c0c58929bdebdd0

SHA512
a40202fbb0233d366f2c8dcf51413f162ef1ea4e4d6037027284fbaf34c0cb5f4a30bbf218f0efb4176b1030b4b67d72f027883a6705de0531ecc442387c0dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d109ecc4d38073f98f99b856558762

SHA1
15aa125a158c480db973fc5765c34c60ad55fc24

SHA256
20433589f34114a755eb10be1a504fe85e732255efc40f0fbfa270b56bb91b4c

SHA512
aae38bc82292eda16384cb6264b619743e9df3a3106e44de8af0238b772e86222e71a9af3016c5551b9d20adbff28683c4c4d2e5df182c3bd37686dba71cd8ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ff1dfdf6826b7ce7d2e3e12762eb85

SHA1
31392bca395434374e16d98bdfebf761e2761633

SHA256
f47b006b4d912a5b2c97ed3e57a3892f3b97c12acf81d50f1d7d4b727d62b6ef

SHA512
05a5bdcf8eeda2d5fbcdbdad3e17bc1108f47c7b8f7ed5f22f99cd1de7eabc93893ee6864a1642340d3630baaf6868a993c63f1fec2852b64ccd9088b72929be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f724463732131473e58bc80765e69bef

SHA1
5f63a45a86b3b24fed9a5e31479388b36094ed8b

SHA256
4ed3cf3d82a7f5e516167fd3d329db818077e3b258088e0d0c95a86d7d3b7c02

SHA512
895652e832a5d892a36697aed3261ee90c03fc368a679a3514b59a563fff11becc42f639c08fd4ea8a9dedf92f66c6a9fddf55de67bf75793fd9377127fb1091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb25d497f1fe40c75ec3aa05badde1f7

SHA1
9609f39760502c8cf0890ec9db24ac1f5b93492b

SHA256
aa46ed6ec4cbfb982880e3c180d97612c5624918393a5c2fb3024292b0074413

SHA512
152eb93891582aa2dd390f0fe8d2824b91a332ecd9251cbc14d9c2518b8c71c959ccb9bfc796d2b01ac227a67951e299ef9a09caf75572c361f2f63119e4c0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc733e616dac1c18409792dce71a061d

SHA1
dd53d4fc0221a1e566ccb981019e3a226562592a

SHA256
340173752e566e1e131a0c4325e886f1a5a0eff90b51b7ca6f703a7090b50254

SHA512
f09aaabf56423cf2d3d95238d3a95f903132e7198719d7d7951d2b417243197fba50d6dcb315c14d2e1eaddc9e7b31df63c4c015d56a11a303b20e02b86c0333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df2d644c67b059495aa64af747ec2748

SHA1
f9afc0d7d9bd2e3cf5ce0cfc5c7553dd02c14386

SHA256
fd5689508dc8685b60c42eb8d4c43a1a303e5410b317aeaa38956ec8698148d6

SHA512
4e7bffb0abf9152cb5b376fc59527f82e5521d945ee6ab2479302548ea7eb8e46e5f1cfa774ac6c25d3b9d64d6cbb41b930f57dae839f94db2c75604fa1bc4f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4ecc047841cbff1532b2a91dc4089d

SHA1
13b49701df8344e50517adfeac78b7550cbf74cc

SHA256
a960002d79a6c95398da993ef0b87e06e7427055c8087c39038b4044e7062a37

SHA512
680b4e1338e7f7feeaf1e19a8e45906a2e076fae3d18d67816cbc046e39f6a6ff8e07118256fb5886d7f782e62bf7ea706bc94a2ba11831aa547aec702befcc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1388cbde9b8d67392c777749e22a1842

SHA1
35a0cd4f4815d311e09c2eeb01b86cc81ec62d61

SHA256
676bc8f7d200726f66d45c8bcef4c9d7f70737f364fa7755478fa2e3b5a26625

SHA512
3726848fd3e8abbe7c9515b0fdabf6a4b522b8f6f446dfd9d1fc55ed54c45a2e9ce990768bb20472a83a0060259a93b8baf55605a90b92bd97bfb6cb97968be1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27eefb67e24a263a5b5b6400820b7bdd

SHA1
f8c0e43364a6ab8e00a19eb842876b42af7ec333

SHA256
283f52be799ac122ea42a0d3a30e6847867708569a7783c1f757149babb68c2d

SHA512
78a980ec96e3e355a4b04dc79c9d281a1094f2e308fca2543a8721988550020da0a06ca68e9c22566137cd18cdba8ce7ae4a2ed97d0e22550915f2db7d10a9e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0db2c057111c6a3e4bd62b2953247778

SHA1
5b4352198c8459df01f6ded13dc8257b7296909e

SHA256
95b8b5d99547c6443a3a36f8f4a3027a104c0641ecc7ad583efe3e6f567f3410

SHA512
b2b303a2f3862d189ed639325288fee24b1ce0fcb42c15102f2d76786b2352e2a0abf76a0843f9dc409b6df7b3fa0bbc6dc4b7a1900e609674ba862b49d03f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6880fa2c7df52c3cc628470d71c52b5

SHA1
be442f91529413f700631779284ee2def73875ba

SHA256
2e2c9fd43acad25cec6fc763d756acccce79cdec22a2c3c0a2d912f475ed3cb6

SHA512
b3163340937e9b6869aeb4df1e8382983c47c9e8749d484a5cc653c5522f94e57d0a1cb1938035ab74326cbfecadd8508667ed2a16de31f650464951a9e3a685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39af46b5ee13371b4bd107ed5324f5ff

SHA1
35bab7ba3469b903638ee6bbb7eb0b6f1c3f92be

SHA256
00368ac948eef34a9a863ac935c29afe2216ee77318ebcaf7bd439e2ba923272

SHA512
311e92b54e96cf4b0873879d6ffeb6890fa8c8997df9ba766251fdc8f428f67e7a0b0708354df33b648f7cee944c1933c642b60c50cd3b15436ca712f725b333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5632ea43c29ed90ecdc671a2024f73c

SHA1
a8b10f2b9639aaf1546b29d51f07e75701c768df

SHA256
1738b62e098e94a9a6b7474591e175d19b2299e43168ee6c3d11e4d3d6dfb563

SHA512
cef421b43df3fa122bbc3b55b0240ee4acd5d74fe9dec1e021011abf7d0b45b9f5e777fee9674d8686617fece3948fbb4e9dd96975d68d1760391bd47936ffbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934f836b4d20d3e1e6a3c95961bb8871

SHA1
a6d2afdc4bcab7b4af6c557009f47af4cc4fb9fa

SHA256
a6f45c833b282201b10d1bcf0b9104d9e9819d566cd5357082514af32d3e4bf8

SHA512
a8458c30b6d156fd5147cb8534797587eb9796fd82406d1974879217b8caac454c148deccbe4a6e15abfb1ce5de3ab3547b3f9f55d4f72efcffd1bf1aeb68b28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c9b42dadd6843baee77d3f26979d828

SHA1
00b27e6992bd24eda5ed9c29ca228ac590354349

SHA256
7e0d6b173eb32f2ea468abfd5b47a92e99dbc50816ea364fbff03b9793ef9afa

SHA512
af160dd738ecb82c5502cc965b90393ebc267d971611641b597991074e1b20d7eca1d4f655610e8a1c13e1e0237828cfa097aa2160090aa7b5892cd3e29eb2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35be82ff827c04483607cdc22bd94aa2

SHA1
d70099f9812d275407d62ffa31ed1dabf2b44297

SHA256
41a16a53fc4aec9027a3ea85e3f5ab8a5540f5eca50a995e35841a44ba53ade6

SHA512
29161c9464972797a4b314cd423d4481f78ae0a97ebf4f5d09f0fc87e6b966f773fe6bee3d0e881e48b1c71be47eb3554b331bd8aadd7c028fe88c20481d975b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa14030d64d878550d3041e8204a6ec4

SHA1
f2edd24392498cc855800ffa1e78dcad237bde25

SHA256
c71e64a4dc3cbcd2ff107ca3f6542d00f90d03503a990b4e8caf150c15ab6a72

SHA512
8132ec80b6533ac1496524d4acec46b3be8612ddfe9b23e5533efce61a3cbe29b7d93cb37fddbb6a7575447a8363059c6846c5ed02677fd5c0e32aaa9b2b209e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dde24660ae8a9463f5bbc6a49864375

SHA1
ea42d8812436f114e8d5831708e2d09fdca17445

SHA256
c4b78126b6d6eb28d7cab5b0293892d29dc1c961d337337fe848b25c9c3cf262

SHA512
1cc4401e53dbdf302291e08ec7cc3990144f445fd570e4b93d784d96738a0bdd5eec1d770e753cab029dc62d9433ffc4b4775b4fe5edf162390ae67ca87dcd8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67afd1f272f448b0d40a6eb08107f0d

SHA1
4a85a75f8a0444c9fe387c4055088a1ef1c3c3b2

SHA256
e87114c1f9812b536606415a5eae1d619e2bdd5dd16f9db517979127a61c1982

SHA512
ed493d5025379b21b4d68a7fd3a05970e8b29a44083bc072a8443f652f986255fa7d9e92b5221d0f533479b726ff014aa256071bc50f9a7d27575caea8d8db39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9219c78e97efe0199b37eb81c208e7c

SHA1
4c20b69bad88772f9591c44c88818a3e47c5ae8b

SHA256
4cd2e6d61c80fe80f6ad515ab7cd03f1050d5c1a7f4e00c639a292e5bdb051c5

SHA512
8dde96051accb3dced7a2f9ee050c48c77dd3b6028f088973d927439dbb2cc737456374bda48f9eca20545f2d186254d6ca4390d3b801c993eed94da28140c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01176ecf665228236f689db493a9e330

SHA1
9a8543ad406ca3fd0e6e5779787a04db6acc6e30

SHA256
807ea4858e7ab45b71933edaac0819f596e63060c742a578f9eb2947b1acf278

SHA512
a13a4ce79d61b45c42211ab35074d7fd9ceda85ca5a9fa33fdf7d35ff88863b7fd57e9c8d07e976fe65c165ff3ae5b4fd5cf13e501d1f2584cec442b81db2739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a9c6a01d31fbf870d32cea111105e4

SHA1
3147a20b6c6e23607303a326a106aff2619ac423

SHA256
02702c90550005657666aa49a83c3355fcdbb7d72c41c857285f6b8c5797eb43

SHA512
7df2af515219802c24c7f7d0a95116d6cb72f4df765763940c23385dde55a5aab5be71baff078fca46d0fce6d2b8a39dd81111f953d6236ca1efdd2469f3e539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f96582592d916171972dc99b71684f

SHA1
2be0dd58489470e5deaf07db3305b999b6cd85ba

SHA256
f67ae8db62365c07fb13ad0fc9387f71f619aba298a66056e5b99d48e8207d4e

SHA512
f024e5092565b92753f7d4fba8bdc4daf5cd2a8a90971fb28459e3341906d967f5af500ccb01d90ca3e72c9fff216b8cf49378844f89d6600bbfa06a919e3174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25edbf67826d22f6e630c982f1e0b242

SHA1
5226ae46c95b811d1c411dfacbd4a24a8370fad0

SHA256
c0953b9c8e0181048dfa81e04a1016178a67723ab566b8c11a4aaf8133ce6968

SHA512
7d0a587979000d41af31801979ea4e9cde54df10d797321030ef902bf31a9fb4b23e121e6101c6560dd53a811e996733a8f51163741f753b1331d021804cb2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5b31cf8e6885c82903cf043b7f70b8

SHA1
58a132de66f572b562b816294168d52c6f108ebc

SHA256
f299f44267b0bbd0170bcbe97bb32b1c76cf9341e1a9eb9a86e1900bdcb69eaa

SHA512
ec2241599d0cc64c8f5d18d4153f554cd48461bdbdbfdffa942cbbf0e20386f4550280b2f67a7bb9a2591a40afbd9158968d3b4445833e48418414ecff4c2d5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e347f0ce4f43ca80187d097a2b475bc

SHA1
96b3900c8ebd44c4bb63c95121ffbf97f2b5806d

SHA256
752c57f66484d56c8ffc55b7d8e165f2fc3c294d405a99b3f9110a3f86241232

SHA512
e2361d0c48f007ba355652f77c4e3d4c773191a76cbb1aacd36d413d557b0722ccd1ae339011fe026242d6ab7095eb04846c33ddafebeea35c22c978063de7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f453e87c9fc2b318d9d342dfb316b9

SHA1
d1a2291f8fd6777f6f4182e2f9ec0ffad6a678d3

SHA256
832aef3e5de4def02ef317057dda63ea2ffce07745a0e69775c8bb74d0e205ad

SHA512
3ed464ebe2cb4bec3c9cc8a776eee820d76d74354aac2991a2664fd84d3650cb8f96e4e115062bee01c2b7bcff44bf6dc7b9759640df0b03c2cf379ed2129c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d79b455feb0a07c80f4e886d0d21569

SHA1
de0347faff460f626c9349496cb3193f02dd970b

SHA256
7500fca9d576364f37882eb6856ace13d6163205908ff8c7f80993aad9c2855d

SHA512
e2ee240a1787c786084df24aa5d2a499ddecb6406f1566d31bddc0433c578c72055ecd521dba696b4d034c17cb476ca4c6236c430cc29ee6fe610489fe8aaf07

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCAA0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD34C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
216KB

MD5
48f7a6597b661bb0d3382a3aa2c84d00

SHA1
3d635ef974ad3bb4d94daab6e875b59bbfa37320

SHA256
35d39adc1de38ea66a93f9fe23a1fa2b784b61bb00c7666c8562268c6a91f451

SHA512
ce394adcc2aa08e886bc88b02d32861eeb9160c7874bbfb5f96f52f4567d593fde25eb22a84740677ad34b6fcd3d6004c9cfc1254ac2066ced3361a8a70abe9b

Download Submit
memory/2028-46-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-1256-0x0000000004260000-0x00000000052C2000-memory.dmp

Filesize
16.4MB

Download
memory/2028-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-856-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-61-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-2118-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-664-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-50-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2028-49-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2324-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-25-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2324-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2324-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2412-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2668-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2988-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download