14bd4541137ec39fafa313003dbaa93d31ee5c1dcbc90e8287dc279683a9ba20

Analysis

max time kernel
3s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6476bbf019b75400e65de9d79edcefb2.exe
Size

70KB
MD5

6476bbf019b75400e65de9d79edcefb2
SHA1

f2bf1ffcdcaafcf91d9afb94e2f2d9bc723cb394
SHA256

14bd4541137ec39fafa313003dbaa93d31ee5c1dcbc90e8287dc279683a9ba20
SHA512

070adb617df5e85d460f5ba1c5c7da0a4ced96e80bc4182b780258710406ba7e2b58bb68bff427b352cee012930000dbd706564644ae4f4f43a328a53e611d3a
SSDEEP

1536:1LHIlfH7Q6qRBwWa2qxQFZA+j6L0Ww+9:1oS6qcWjqazp6LNR

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\Lubang Hitam.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Lubang Hitam.exe"	CSRSS.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 9 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Black Hole.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	LSASS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SMSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Black Hole.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Black Hole.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Lubang Hitam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CSRSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	LSASS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SMSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6476bbf019b75400e65de9d79edcefb2.exe

Windows security bypass 2 TTPs 27 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Black Hole.exe

Disables RegEdit via registry modification 18 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SMSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Black Hole.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Black Hole.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	LSASS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Black Hole.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 8 IoCs

pid	Process
2564	Black Hole.exe
2916	Lubang Hitam.exe
2940	WINLOGON.EXE
892	CSRSS.EXE
2888	SERVICES.EXE
1692	LSASS.EXE
1208	SMSS.EXE
1336	Black Hole.exe

Loads dropped DLL 12 IoCs

pid	Process
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe
2468	6476bbf019b75400e65de9d79edcefb2.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	LSASS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	LSASS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	LSASS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	CSRSS.EXE

Windows security modification 2 TTPs 36 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Black Hole.exe

Adds Run key to start application 2 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	LSASS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	CSRSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	CSRSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	Lubang Hitam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	Lubang Hitam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	LSASS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	Lubang Hitam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	SMSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	CSRSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	LSASS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	Lubang Hitam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Black Hole = "C:\\Windows\\Black Hole.exe"	SERVICES.EXE

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\Z:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\Y:	WINLOGON.EXE
File opened (read-only)	\??\Z:	WINLOGON.EXE
File opened (read-only)	\??\T:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\G:	WINLOGON.EXE
File opened (read-only)	\??\M:	WINLOGON.EXE
File opened (read-only)	\??\O:	WINLOGON.EXE
File opened (read-only)	\??\M:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\O:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\W:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\N:	WINLOGON.EXE
File opened (read-only)	\??\T:	WINLOGON.EXE
File opened (read-only)	\??\U:	WINLOGON.EXE
File opened (read-only)	\??\I:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\L:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\N:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\Q:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\B:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\X:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\B:	WINLOGON.EXE
File opened (read-only)	\??\E:	WINLOGON.EXE
File opened (read-only)	\??\I:	WINLOGON.EXE
File opened (read-only)	\??\Q:	WINLOGON.EXE
File opened (read-only)	\??\X:	WINLOGON.EXE
File opened (read-only)	\??\R:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\V:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\S:	WINLOGON.EXE
File opened (read-only)	\??\V:	WINLOGON.EXE
File opened (read-only)	\??\S:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\U:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\H:	WINLOGON.EXE
File opened (read-only)	\??\W:	WINLOGON.EXE
File opened (read-only)	\??\E:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\G:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\J:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\K:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\P:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\Y:	6476bbf019b75400e65de9d79edcefb2.exe
File opened (read-only)	\??\K:	WINLOGON.EXE
File opened (read-only)	\??\P:	WINLOGON.EXE

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\Autorun.inf	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	F:\Autorun.inf	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\Autorun.inf	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	C:\Autorun.inf	6476bbf019b75400e65de9d79edcefb2.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Shell.exe	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\Windows\SysWOW64\Destruction.scr	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\Windows\SysWOW64\Lubang Hitam.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\Lubang Hitam.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\Shell.exe	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\Windows\SysWOW64\Lubang Hitam.exe	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	C:\Windows\SysWOW64\Lubang Hitam.exe	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	C:\Windows\SysWOW64\Destruction.scr	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Lubang Hitam.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Lubang Hitam.exe
File opened for modification	C:\Windows\SysWOW64\Shell.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\Destruction.scr	WINLOGON.EXE

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Black Hole.exe	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	C:\WINDOWS\Black Hole.txt	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\WINDOWS\Hacked By Gerry.txt	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	C:\Windows\msvbvm60.dll	Lubang Hitam.exe
File opened for modification	C:\Windows\Black Hole.exe	WINLOGON.EXE
File opened for modification	C:\WINDOWS\Black Hole.txt	WINLOGON.EXE
File opened for modification	C:\Windows\Black Hole.exe	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\WINDOWS\Black Hole.txt	6476bbf019b75400e65de9d79edcefb2.exe
File opened for modification	C:\WINDOWS\Hacked By Gerry.txt	6476bbf019b75400e65de9d79edcefb2.exe
File created	C:\Windows\msvbvm60.dll	Lubang Hitam.exe
File opened for modification	C:\WINDOWS\Hacked By Gerry.txt	WINLOGON.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	LSASS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	LSASS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	Lubang Hitam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Lubang Hitam.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	CSRSS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	Lubang Hitam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	Black Hole.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	LSASS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SMSS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	CSRSS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	SMSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	SMSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Lubang Hitam.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	LSASS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SMSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	LSASS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	Black Hole.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	Black Hole.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	Lubang Hitam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	CSRSS.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Black Hole.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	CSRSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Black Hole.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Black Hole.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	CSRSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	LSASS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	SMSS.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	SMSS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\SwapMouseButtons = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Lubang Hitam.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Mouse\	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	Black Hole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	CSRSS.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DESTRU~1.SCR"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Lubang Hitam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	LSASS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	SMSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Black Hole.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	CSRSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	CSRSS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\Shell.exe\" \"%1\" %*"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	6476bbf019b75400e65de9d79edcefb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	LSASS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Black Hole.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2564	Black Hole.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1036	shutdown.exe
Token: SeRemoteShutdownPrivilege	1036	shutdown.exe
Token: SeShutdownPrivilege	2592	shutdown.exe
Token: SeRemoteShutdownPrivilege	2592	shutdown.exe
Token: SeShutdownPrivilege	2976	shutdown.exe
Token: SeRemoteShutdownPrivilege	2976	shutdown.exe
Token: SeShutdownPrivilege	2024	CSRSS.EXE
Token: SeRemoteShutdownPrivilege	2024	CSRSS.EXE
Token: SeShutdownPrivilege	1512	shutdown.exe
Token: SeRemoteShutdownPrivilege	1512	shutdown.exe
Token: SeShutdownPrivilege	1640	shutdown.exe
Token: SeRemoteShutdownPrivilege	1640	shutdown.exe
Token: SeShutdownPrivilege	2304	shutdown.exe
Token: SeRemoteShutdownPrivilege	2304	shutdown.exe
Token: SeShutdownPrivilege	1680	conhost.exe
Token: SeRemoteShutdownPrivilege	1680	conhost.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2468	6476bbf019b75400e65de9d79edcefb2.exe
2564	Black Hole.exe
2916	Lubang Hitam.exe
2940	WINLOGON.EXE
892	CSRSS.EXE
2888	SERVICES.EXE
1692	LSASS.EXE
1208	SMSS.EXE
1336	Black Hole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1036	2468	6476bbf019b75400e65de9d79edcefb2.exe	28
PID 2468 wrote to memory of 1036	2468	6476bbf019b75400e65de9d79edcefb2.exe	28
PID 2468 wrote to memory of 1036	2468	6476bbf019b75400e65de9d79edcefb2.exe	28
PID 2468 wrote to memory of 1036	2468	6476bbf019b75400e65de9d79edcefb2.exe	28
PID 2468 wrote to memory of 2564	2468	6476bbf019b75400e65de9d79edcefb2.exe	31
PID 2468 wrote to memory of 2564	2468	6476bbf019b75400e65de9d79edcefb2.exe	31
PID 2468 wrote to memory of 2564	2468	6476bbf019b75400e65de9d79edcefb2.exe	31
PID 2468 wrote to memory of 2564	2468	6476bbf019b75400e65de9d79edcefb2.exe	31
PID 2564 wrote to memory of 2592	2564	Black Hole.exe	32
PID 2564 wrote to memory of 2592	2564	Black Hole.exe	32
PID 2564 wrote to memory of 2592	2564	Black Hole.exe	32
PID 2564 wrote to memory of 2592	2564	Black Hole.exe	32
PID 2468 wrote to memory of 2916	2468	6476bbf019b75400e65de9d79edcefb2.exe	35
PID 2468 wrote to memory of 2916	2468	6476bbf019b75400e65de9d79edcefb2.exe	35
PID 2468 wrote to memory of 2916	2468	6476bbf019b75400e65de9d79edcefb2.exe	35
PID 2468 wrote to memory of 2916	2468	6476bbf019b75400e65de9d79edcefb2.exe	35
PID 2916 wrote to memory of 2976	2916	Lubang Hitam.exe	36
PID 2916 wrote to memory of 2976	2916	Lubang Hitam.exe	36
PID 2916 wrote to memory of 2976	2916	Lubang Hitam.exe	36
PID 2916 wrote to memory of 2976	2916	Lubang Hitam.exe	36
PID 2468 wrote to memory of 2940	2468	6476bbf019b75400e65de9d79edcefb2.exe	38
PID 2468 wrote to memory of 2940	2468	6476bbf019b75400e65de9d79edcefb2.exe	38
PID 2468 wrote to memory of 2940	2468	6476bbf019b75400e65de9d79edcefb2.exe	38
PID 2468 wrote to memory of 2940	2468	6476bbf019b75400e65de9d79edcefb2.exe	38
PID 2940 wrote to memory of 2024	2940	WINLOGON.EXE	125
PID 2940 wrote to memory of 2024	2940	WINLOGON.EXE	125
PID 2940 wrote to memory of 2024	2940	WINLOGON.EXE	125
PID 2940 wrote to memory of 2024	2940	WINLOGON.EXE	125
PID 2468 wrote to memory of 892	2468	6476bbf019b75400e65de9d79edcefb2.exe	41
PID 2468 wrote to memory of 892	2468	6476bbf019b75400e65de9d79edcefb2.exe	41
PID 2468 wrote to memory of 892	2468	6476bbf019b75400e65de9d79edcefb2.exe	41
PID 2468 wrote to memory of 892	2468	6476bbf019b75400e65de9d79edcefb2.exe	41
PID 892 wrote to memory of 1512	892	CSRSS.EXE	42
PID 892 wrote to memory of 1512	892	CSRSS.EXE	42
PID 892 wrote to memory of 1512	892	CSRSS.EXE	42
PID 892 wrote to memory of 1512	892	CSRSS.EXE	42
PID 2468 wrote to memory of 2888	2468	6476bbf019b75400e65de9d79edcefb2.exe	44
PID 2468 wrote to memory of 2888	2468	6476bbf019b75400e65de9d79edcefb2.exe	44
PID 2468 wrote to memory of 2888	2468	6476bbf019b75400e65de9d79edcefb2.exe	44
PID 2468 wrote to memory of 2888	2468	6476bbf019b75400e65de9d79edcefb2.exe	44
PID 2888 wrote to memory of 1640	2888	SERVICES.EXE	46
PID 2888 wrote to memory of 1640	2888	SERVICES.EXE	46
PID 2888 wrote to memory of 1640	2888	SERVICES.EXE	46
PID 2888 wrote to memory of 1640	2888	SERVICES.EXE	46
PID 2468 wrote to memory of 1692	2468	6476bbf019b75400e65de9d79edcefb2.exe	47
PID 2468 wrote to memory of 1692	2468	6476bbf019b75400e65de9d79edcefb2.exe	47
PID 2468 wrote to memory of 1692	2468	6476bbf019b75400e65de9d79edcefb2.exe	47
PID 2468 wrote to memory of 1692	2468	6476bbf019b75400e65de9d79edcefb2.exe	47
PID 1692 wrote to memory of 2304	1692	LSASS.EXE	48
PID 1692 wrote to memory of 2304	1692	LSASS.EXE	48
PID 1692 wrote to memory of 2304	1692	LSASS.EXE	48
PID 1692 wrote to memory of 2304	1692	LSASS.EXE	48
PID 2468 wrote to memory of 1208	2468	6476bbf019b75400e65de9d79edcefb2.exe	50
PID 2468 wrote to memory of 1208	2468	6476bbf019b75400e65de9d79edcefb2.exe	50
PID 2468 wrote to memory of 1208	2468	6476bbf019b75400e65de9d79edcefb2.exe	50
PID 2468 wrote to memory of 1208	2468	6476bbf019b75400e65de9d79edcefb2.exe	50
PID 2916 wrote to memory of 1336	2916	WINLOGON.EXE	51
PID 2916 wrote to memory of 1336	2916	WINLOGON.EXE	51
PID 2916 wrote to memory of 1336	2916	WINLOGON.EXE	51
PID 2916 wrote to memory of 1336	2916	WINLOGON.EXE	51
PID 1208 wrote to memory of 1680	1208	SMSS.EXE	196
PID 1208 wrote to memory of 1680	1208	SMSS.EXE	196
PID 1208 wrote to memory of 1680	1208	SMSS.EXE	196
PID 1208 wrote to memory of 1680	1208	SMSS.EXE	196

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	Black Hole.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoAdminPage = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoAdminPage = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLowDiskSpaceChecks = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WinOldApp	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoPwdPage = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoAdminPage = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLowDiskSpaceChecks = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoAdminPage = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLowDiskSpaceChecks = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles = "1"	Lubang Hitam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WinOldApp	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\Disabled = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinkeys = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WinOldApp	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	Lubang Hitam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinkeys = "1"	LSASS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	LSASS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\Disabled = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	CSRSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoPwdPage = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayItemsDisplay = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	SMSS.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles = "1"	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	SMSS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Black Hole.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles = "1"	6476bbf019b75400e65de9d79edcefb2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles = "1"	SERVICES.EXE

C:\Users\Admin\AppData\Local\Temp\6476bbf019b75400e65de9d79edcefb2.exe
"C:\Users\Admin\AppData\Local\Temp\6476bbf019b75400e65de9d79edcefb2.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2468
- C:\WINDOWS\SysWOW64\shutdown.exe
  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\Black Hole.exe
  "C:\Windows\Black Hole.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2564
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\Windows\SysWOW64\Lubang Hitam.exe
  "C:\Windows\system32\Lubang Hitam.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2916
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\Black Hole.exe
    "C:\Windows\Black Hole.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Windows security modification
    - Adds Run key to start application
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1336
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:1812
  - - C:\Windows\Black Hole.exe
      "C:\Windows\Black Hole.exe"
      4⤵
      PID:2036
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:2716
  - - C:\Windows\SysWOW64\Lubang Hitam.exe
      "C:\Windows\system32\Lubang Hitam.exe"
      4⤵
      PID:2596
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:1652
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      4⤵
      PID:1808
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:1144
    - - C:\Windows\Black Hole.exe
        
        "C:\Windows\Black Hole.exe"
        5⤵
        
        PID:1556
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1792
    - - C:\Windows\SysWOW64\Lubang Hitam.exe
        
        "C:\Windows\system32\Lubang Hitam.exe"
        5⤵
        
        PID:1724
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2684
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        5⤵
        
        PID:1600
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1376
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        5⤵
        
        PID:916
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        5⤵
        
        PID:2552
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1632
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        5⤵
        
        PID:2764
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2580
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        5⤵
        
        PID:876
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2528
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      4⤵
      PID:436
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:1628
    - - C:\Windows\Black Hole.exe
        
        "C:\Windows\Black Hole.exe"
        5⤵
        
        PID:2700
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1836
    - - C:\Windows\SysWOW64\Lubang Hitam.exe
        
        "C:\Windows\system32\Lubang Hitam.exe"
        5⤵
        
        PID:2120
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2856
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        5⤵
        
        PID:2660
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2620
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        5⤵
        
        PID:636
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1144
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        5⤵
        
        PID:112
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1504
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        5⤵
        
        PID:2108
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2144
      - C:\Windows\Black Hole.exe
        
        "C:\Windows\Black Hole.exe"
        6⤵
        
        PID:1532
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2084
      - C:\Windows\SysWOW64\Lubang Hitam.exe
        
        "C:\Windows\system32\Lubang Hitam.exe"
        6⤵
        
        PID:2612
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2296
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        6⤵
        
        PID:640
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:772
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        6⤵
        
        PID:1648
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:3040
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        6⤵
        
        PID:2616
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2532
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        6⤵
        
        PID:2936
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2132
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        6⤵
        
        PID:1304
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2404
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        5⤵
        
        PID:1972
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2584
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      4⤵
      PID:3024
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:788
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      4⤵
      PID:1936
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:932
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      4⤵
      PID:2488
- - C:\Windows\SysWOW64\Lubang Hitam.exe
    "C:\Windows\system32\Lubang Hitam.exe"
    3⤵
    PID:1040
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:2204
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2940
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    PID:2024
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:892
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\SysWOW64\Lubang Hitam.exe
    "C:\Windows\system32\Lubang Hitam.exe"
    3⤵
    PID:1468
  - - C:\Windows\Black Hole.exe
      "C:\Windows\Black Hole.exe"
      4⤵
      PID:1668
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:1732
  - - C:\Windows\SysWOW64\Lubang Hitam.exe
      "C:\Windows\system32\Lubang Hitam.exe"
      4⤵
      PID:2632
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:2452
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      4⤵
      PID:2256
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:2852
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2024
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:2612
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      4⤵
      PID:3028
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:640
    - - C:\Windows\Black Hole.exe
        
        "C:\Windows\Black Hole.exe"
        5⤵
        
        PID:2664
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2804
    - - C:\Windows\SysWOW64\Lubang Hitam.exe
        
        "C:\Windows\system32\Lubang Hitam.exe"
        5⤵
        
        PID:2116
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1920
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        5⤵
        
        PID:2072
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1028
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        5⤵
        
        PID:2744
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2660
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        5⤵
        
        PID:1776
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2068
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        5⤵
        
        PID:2000
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:1876
    - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        5⤵
        
        PID:1736
      - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        6⤵
        
        PID:2284
      - C:\Windows\Black Hole.exe
        
        "C:\Windows\Black Hole.exe"
        6⤵
        
        PID:2524
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2816
      - C:\Windows\SysWOW64\Lubang Hitam.exe
        
        "C:\Windows\system32\Lubang Hitam.exe"
        6⤵
        
        PID:1684
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:1944
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        6⤵
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2268
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        6⤵
        
        PID:2016
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:1716
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        6⤵
        
        PID:2700
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:3044
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        6⤵
        
        PID:1508
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:1596
      - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        6⤵
        
        PID:2156
        
        C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        7⤵
        
        PID:2200
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      4⤵
      PID:2136
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:1536
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      4⤵
      PID:2404
    - - C:\WINDOWS\SysWOW64\shutdown.exe
        
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        5⤵
        
        PID:1700
- - C:\Windows\Black Hole.exe
    "C:\Windows\Black Hole.exe"
    3⤵
    PID:540
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2888
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\Black Hole.exe
    "C:\Windows\Black Hole.exe"
    3⤵
    PID:2820
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:1940
- - C:\Windows\SysWOW64\Lubang Hitam.exe
    "C:\Windows\system32\Lubang Hitam.exe"
    3⤵
    PID:584
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:2236
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    PID:836
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:1820
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
    3⤵
    PID:2396
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:2904
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1692
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\Black Hole.exe
    "C:\Windows\Black Hole.exe"
    3⤵
    PID:628
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1208
- - C:\WINDOWS\SysWOW64\shutdown.exe
    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
    3⤵
    PID:1680
- - C:\Windows\Black Hole.exe
    "C:\Windows\Black Hole.exe"
    3⤵
    PID:2116
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:2572
- - C:\Windows\SysWOW64\Lubang Hitam.exe
    "C:\Windows\system32\Lubang Hitam.exe"
    3⤵
    PID:1028
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    PID:2080
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:1300
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
    3⤵
    PID:2524
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:1104
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    PID:2204
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:1176
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
    3⤵
    PID:2836
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:2608
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
    3⤵
    PID:2544
  - - C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      4⤵
      PID:2168

C:\WINDOWS\SysWOW64\shutdown.exe
C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
1⤵
PID:2368

C:\WINDOWS\SysWOW64\shutdown.exe
C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
1⤵
PID:2964

C:\WINDOWS\SysWOW64\shutdown.exe
C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
1⤵
PID:2612

C:\WINDOWS\SysWOW64\shutdown.exe
C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
1⤵
PID:2704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1578136260-21315786022705180671686163461-13123353501013558843-1259675250736403683"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Black Hole.exe

Filesize
70KB

MD5
0c768853d02b5f1b9650057e89faaed5

SHA1
63ea4f8c4053c8b966d6c2e224ad1fa0947782b3

SHA256
541c44ebcb0f68610f19a9845dec03ac149d205a452418f2a38a7a0349f92901

SHA512
446c842f38f4507bb0c54325992fcec08c55071ee1ebf3cd559ef60ac1fec8d24493f4bfa57bdbb54e9284f7302164310105ab64e22ddd914d84b1fdf21a8557

Download Submit
C:\Black Hole.exe

Filesize
70KB

MD5
2a29d6334e6956c0787d0bdf56be0a0d

SHA1
97f6ab09c0488efd661210a7551896aa84e45bc9

SHA256
9b276b1713a20b4e15a1c1e00f7baab1fae1a50c45479c8799758224f6547eb1

SHA512
0b01d3beca51fc402659fe4341a1802d996d8fb32dcb053003ee5567103301f93b56ba209e9600e1b6957512fce8f7f05fd433e8635f0e41965ab382d0999700

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\118202442545.bmp

Filesize
1.9MB

MD5
4502c51515045aa02a9dd90dd0b0277f

SHA1
bdcc0be9a267658b749af96aafecbd0a35f31c87

SHA256
50e723f8ec136796e6a2d6c2cd91940fc3177734a7281d28d0822e451c40000c

SHA512
13958eb77715103caabc4998a1879647fb77c414587a6b78043b2ad50029b67f2d775cd12b8860a4fbbc1e1180e73466d15c22037a48db4d476e8fd0faeffb2d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\118202442655.bmp

Filesize
2.6MB

MD5
b3830170ee157ca341668ed47c9963e9

SHA1
c9eb2a77da8eafc1ae050c1f47e92c5ddc2972fd

SHA256
21ce1dccb1296647578575ac05bec622c672969fc221af22bb3c4c94b1b360ca

SHA512
589012b1794954d26a444b378608fcfdab2e7446db18b9b881398eb486ea60bd7102c48ac73ec5d5c2c1154489470593bfaf36569c134e898ee9d157d04a349d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
70KB

MD5
7fbf65ae60bd70bd04f8116d2be73fa2

SHA1
0d396b021c18f34e660664b4978652329de8c18e

SHA256
0c5dab7b3e5c148c9bc53f2701bffabdd268a5cc24239aa9763256a36d6baa12

SHA512
aca3334eef339d4dcfc9c04b2b2b58328448d525efa15ab8d4a0bbe73f56338c88262be808baeedda95efbb178261ae78df0b62bca1862bd514716835d348d24

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif

Filesize
70KB

MD5
d1642a6447c9c1f88847d3db6f37f29c

SHA1
29a92100f7db37c6ee3c9cd77024c48b691dcea4

SHA256
d10a5921004009796e018bcac938fec9dca5dd0a13540cc59b6f76325d47c910

SHA512
7d7ae2a660536290e8572ed84c595e87c704fdbe346791fc71844b48acd408aff3c21566603a948088b74d174a1364c5406d5d896da51026e440e3607f57a750

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif

Filesize
70KB

MD5
0db0a1dd398d96a61650fff93cade594

SHA1
06ed2a4652cd2b04c14198c97aecc79bee288eeb

SHA256
2cf371499bbe9f924343e18e347c0034b1a4549b880f560632c3e63bfea1609b

SHA512
8ef8c69fc7c6220f18e872e21b97c2193a8bf67dca2874e3e93c7eda1c0eda8a0312f37d83d854060e25650fa781280624ecb4024f1c27c163869dd24bfd3403

Download Submit
C:\WINDOWS\Black Hole.txt

Filesize
1KB

MD5
6635e047c242e6d64b2716d81095bf5f

SHA1
5def5300f894e58bbb0caaa94680f7735ccd248d

SHA256
9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

SHA512
c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

Download Submit
C:\WINDOWS\Hacked By Gerry.txt

Filesize
1KB

MD5
e067dafcbe64a95f5045a281397732db

SHA1
1af7095f98c486ca247449980000d06b04ffc50c

SHA256
b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

SHA512
1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

Download Submit
C:\Windows\Black Hole.exe

Filesize
70KB

MD5
c3a9df9cc65317076fc4ba1df5ef5745

SHA1
52bb940eca5354c8928a2422bcacd9e2cebab205

SHA256
0ba5e2ac2d0a10a9ce1ca9584232d5f5bbc4a0c48a01909a589b060bd2a3be5b

SHA512
a6421942bf45a45fefbc5230f9115b2e5a0785dd228d3d190cbc090e7aaddf57f30010816ee6a23fcd29e9868d08ae7bd0ddec59460e4a2e34aa4cb7228d6d4a

Download Submit
C:\Windows\Black Hole.exe

Filesize
70KB

MD5
9c4a146d323b00a3cb0edcef7178bd3b

SHA1
1cbf3aaefc9ce44a47255b5a42b2572f6972be4d

SHA256
ea9c8210b9f3311c4cb47a69fe875f4a5005b27d6b22a77462d06fbd5fc9b23f

SHA512
3d3f197c2cae3355c49b2578a62d2ec23d3151fa5229053ad322e8dc47eb9dcd024ab12a4941a7716c1363bee119d9fcc1c8b8586fad3962098097eb5dabbe13

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
551KB

MD5
67bb3be10efb4e541a9f3283fc149934

SHA1
279a8ba284656b05d4ec19828c23ce72170e3349

SHA256
d262930a7ead73ea6dd9dd2d480608783601eb3700520b7111a71492ceb6622c

SHA512
faf87c593cdaa1a8e06f13a0e132722a71be4be7c37d10ac65722f75af0a6c5d480184df978f086766413e9e586a00493ee2e53f6bc6632ccde2655f308f7575

Download Submit
C:\Windows\SysWOW64\118202442555.bmp

Filesize
2.6MB

MD5
4abb42b0b8072c7f09a199828f946df9

SHA1
3f71e74bed509a46c23f8b41011446e412812066

SHA256
dace681d4f005ddff778ef6862383f47a23141c3427a144ce77e1ab23aa94570

SHA512
49f245163195337eaab56945ea0257a8a01b4aa6a0adcbfd7d4bc37e174e44927c38e4ce3470d9f9f29a487455066a8f7ee15ea7ee8cc0f646e824ce6baf628f

Download Submit
C:\Windows\SysWOW64\Destruction.scr

Filesize
70KB

MD5
c948d560e2d7d9acec6e94ee00e8bbe3

SHA1
47f6db0ae3abbe7acb0bdc9b1f834ae673f2034c

SHA256
bf8192d3a7daa80828eb6790eb9bc063c6b81a3be1d149718904a1a51026a1b8

SHA512
28997617283163beaa50969cd6c778da9919e03db3ae61db10a0b3319a17afe5bdb482d525ae9719e37a15e49dc3a58f77df5ead93e6870e8f9d2e6687f4b21b

Download Submit
C:\Windows\SysWOW64\Destruction.scr

Filesize
70KB

MD5
f6b2827788689b4fb1ab81b188502d71

SHA1
0aac111948e6b126b66a0767954724dea4bfb12e

SHA256
2b3e6db39c47dc4ea9f669b733accd9715a082dc2f9190779490efe38b1f6d9b

SHA512
f244c90429981e0aeb681a2978589ff8f9209d55c97ed33193f6b5f77a206a4d56198deccd5f9a22ddb893d818107140f72c6d2bdc463e0986da0f5acedcd17f

Download Submit
C:\Windows\SysWOW64\Lubang Hitam.exe

Filesize
70KB

MD5
6476bbf019b75400e65de9d79edcefb2

SHA1
f2bf1ffcdcaafcf91d9afb94e2f2d9bc723cb394

SHA256
14bd4541137ec39fafa313003dbaa93d31ee5c1dcbc90e8287dc279683a9ba20

SHA512
070adb617df5e85d460f5ba1c5c7da0a4ced96e80bc4182b780258710406ba7e2b58bb68bff427b352cee012930000dbd706564644ae4f4f43a328a53e611d3a

Download Submit
C:\Windows\SysWOW64\Lubang Hitam.exe

Filesize
70KB

MD5
2eb74659135e5b2cba3338165978e12d

SHA1
00567299646404ebe8e7ebb506ba490219c97a49

SHA256
c7f5d8d9ba9c98fadb9453e31d10abc1770a7cbc27e005f4ba8eaf435a761af2

SHA512
ecfff08f8d376d923a6274a013f8dde12b0fbc78c1895e07c6f289fe04d24b2b68fa27879823e1781300b1851cb66209392442f3e21b616a0220b0f8af66dd67

Download Submit
C:\Windows\SysWOW64\Shell.exe

Filesize
70KB

MD5
2efcc3ad040a2ea55a12942c74de04de

SHA1
7302b280718c006737f73bc02f521ed75f951b9f

SHA256
35d2cef1a7bc449971df5b2d39d3d58ff8ab80a386efe1e0575f22f89e128595

SHA512
19b9d4c1f55f376aa7d46c5e170e1029ff8a799108360836dafab1f560984e0ef0e763cee34c5b53cbd07e7327d528e221fa0f1697e8e7da781c39abaeaa5ac3

Download Submit
C:\Windows\SysWOW64\Shell.exe

Filesize
70KB

MD5
fbd8ff32100a997616d70b4af5f258ba

SHA1
f8ff7b88661d10ed79e1d78139ceba6b1ceab436

SHA256
453f78f329b3b1ad2deebdd4c9f154202592cfedcc9b8cd9fea1769f98642551

SHA512
8f794f3ce8f0286e45d7b7a673b9d453156a8760c2e1f2e5a68c8b640a99080524a64c6ef5140cc81de789c7267a478a430430b8cda67b8f7bed78f1961f225f

Download Submit
F:\Autorun.inf

Filesize
93B

MD5
4809daf962803cad2b891b94c195d3dd

SHA1
707bdd28edcf5e9e288959f62d4da8823777ec12

SHA256
3468667630714eb86464ecfe903b59a843670ade55b49ac9d653421b91bcf139

SHA512
c9c233b22a853ce17731cb3466f7e8234da4e3de0dec6cc48ed15232303d4f29c49770e20a7064ad9329f8d9d27f8d4b547443d837320f58ac230973bb7dd11f

Download Submit
F:\Read Me.txt

Filesize
3KB

MD5
5c462f1ea2917c0b502ae0761c0f60d8

SHA1
c1d15b093b2843528544d77dc0d9d4e3b8a85297

SHA256
09c76898e4fa4174c53c2ad514274b5d2ca636ec6f223be5fda4c6135ec4ac10

SHA512
e6219ccbabe77a4999ade79c7074753495da9c61d6451c53be34219cc19746ca9a0dadef3b47cd8859cd59604064af5e9fc2a5044780bcfebaaa13dc08c36bbc

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
70KB

MD5
22e946502b7fd84d0066a76418cec06e

SHA1
9ded02cfd63ed093f39f255d46b04451c8cf27e2

SHA256
22c482d18d73af3ab35fe87296da121a5832d3f8fc0d46b72cb83a0a7217c8fc

SHA512
b2284444947cf2d7ae792451fe09ccf98f2a9c7ed66dc61dbaeb1cd7b6503331f2465c3524fef90f39a291970a89effe2e034af6c5a271cadbfd4b42cfcb25c1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
70KB

MD5
e3eec3ce6126fcaf476391867b5246dc

SHA1
befd40ebf8c3d0c131b788951de53e9e455cb13d

SHA256
9d4598641c601c729db2a17368efddaf9e3ae7fdb82732dc693993a827edd696

SHA512
d650517504fdc45117ae400d235fb276e84b19dbb0199c8a85654a800cb8399a793665ff486e956c9839f1658d414efa3ae66e2c2fa27cda6276fd4c9b417c56

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
70KB

MD5
c8bcac30f45bac10572c961771b64df6

SHA1
a5655c9dc3506feba6e6d3bcaa99859f08ab2f30

SHA256
37f4fb18bf33c4e8cfeaca7b6b8a47febb7ef7c3e7faf1bcb144bcff98cd3562

SHA512
ae1a41c620c8aa33f42228d50c4e58b1bc3d595566b37f89a516fbefc078f910a9e757bd555cf03b51ddf3f00e8bfed09d605b39ba80fc4cd1efeaa2f535153e

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
70KB

MD5
5934d40b0cc748ac73715f6d9fcf03bf

SHA1
e0d7464614df25ac503aa4d2bb4ab64bd21b73ed

SHA256
317e08a08850856e0d9026cf687875b6011a1aebc8a64557b2a7fc8688df305d

SHA512
b016092c4b13ad4e938959f238791c4b84b95cfa057531ed7487784920be636266d2103f1773d17199d66e0aa043d0d1ced7e3365d3a6bc68b52034373ab3b98

Download Submit
memory/112-1285-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/436-1092-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/540-385-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/540-454-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/584-1078-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/640-1512-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/836-1104-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/836-1083-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/892-119-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/892-968-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/892-456-0x0000000002EA0000-0x0000000002F0C000-memory.dmp

Filesize
432KB

Download
memory/892-118-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-1060-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1040-270-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1040-271-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1040-450-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1208-1076-0x0000000002E80000-0x0000000002EEC000-memory.dmp

Filesize
432KB

Download
memory/1208-1075-0x0000000002E80000-0x0000000002EEC000-memory.dmp

Filesize
432KB

Download
memory/1208-150-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1208-151-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1208-1270-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1208-1041-0x0000000002E80000-0x0000000002EEC000-memory.dmp

Filesize
432KB

Download
memory/1208-1019-0x0000000002E80000-0x0000000002EEC000-memory.dmp

Filesize
432KB

Download
memory/1208-1133-0x0000000002E80000-0x0000000002EEC000-memory.dmp

Filesize
432KB

Download
memory/1208-1140-0x0000000002E80000-0x0000000002EEC000-memory.dmp

Filesize
432KB

Download
memory/1304-1595-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1336-1047-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1120-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1091-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1042-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1127-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-196-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1336-1089-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1275-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1336-1065-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1067-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1105-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1113-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1109-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1336-1102-0x0000000002880000-0x00000000028EC000-memory.dmp

Filesize
432KB

Download
memory/1468-1287-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1468-988-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1468-1131-0x0000000002570000-0x00000000025DC000-memory.dmp

Filesize
432KB

Download
memory/1532-1489-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1556-1462-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1600-1498-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1648-1549-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1668-1143-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1692-140-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1692-1235-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1692-142-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1724-1475-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1776-1496-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1808-1071-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1808-1074-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1936-1112-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1972-1444-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2016-1596-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2024-1251-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2036-1021-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2036-1043-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2072-1460-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2080-1077-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2080-1098-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2080-1080-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2116-1448-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2116-1040-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2116-1020-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2120-1237-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2136-1316-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2204-1212-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2256-1223-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2396-1205-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2404-1440-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2468-117-0x0000000002850000-0x00000000028BC000-memory.dmp

Filesize
432KB

Download
memory/2468-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2468-1215-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2468-68-0x0000000002850000-0x00000000028BC000-memory.dmp

Filesize
432KB

Download
memory/2468-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2468-111-0x0000000002850000-0x00000000028BC000-memory.dmp

Filesize
432KB

Download
memory/2468-70-0x0000000002850000-0x00000000028BC000-memory.dmp

Filesize
432KB

Download
memory/2488-1129-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2488-1168-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2488-1128-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2524-1561-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2524-1138-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2524-1172-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2544-1265-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2564-73-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2564-93-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2564-72-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2596-1056-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2596-1052-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2596-1053-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2612-1497-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2616-1560-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2632-1211-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2660-1249-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2664-1445-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2700-1603-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2700-1218-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2744-1472-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2820-1051-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2836-1239-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2888-1062-0x00000000026B0000-0x000000000271C000-memory.dmp

Filesize
432KB

Download
memory/2888-1081-0x00000000026B0000-0x000000000271C000-memory.dmp

Filesize
432KB

Download
memory/2888-1141-0x00000000026B0000-0x000000000271C000-memory.dmp

Filesize
432KB

Download
memory/2888-1082-0x00000000026B0000-0x000000000271C000-memory.dmp

Filesize
432KB

Download
memory/2888-130-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2888-1059-0x00000000026B0000-0x000000000271C000-memory.dmp

Filesize
432KB

Download
memory/2888-1197-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2916-257-0x0000000002750000-0x00000000027BC000-memory.dmp

Filesize
432KB

Download
memory/2916-87-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2916-195-0x0000000002750000-0x00000000027BC000-memory.dmp

Filesize
432KB

Download
memory/2916-1580-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2916-306-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2936-1573-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2940-103-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2940-424-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2940-105-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3024-1106-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download